A client that recently installed a new accounts payable system assigned employees a user identification code $($UIC$)$ and a

separate password. Each UIC is a person's name, and the individual's password is the same as the UIC. Users are not required

to change their passwords at initial log$-$in nor do passwords ever expire. Which of the following statements does not reflect a

limitation of the client's computer$-$access control?

A$.$ Employees can easily guess fellow employees' passwords.

B$.$ Employees are not required to change passwords.

C$.$ Employees can circumvent procedures to segregate duties.

D$.$ Employees are not required to take regular vacations.