I once had a client who had an office manager who controlled access to everything, including the ability to write payroll checks even though they used ADP. If others wanted to help with the work load, they could not if she was not there or disapproved. Then my client's spouse became very suspicious and asked me to investigate things quietly. It turns out there was unreconciled bank items, unexplained hand written payroll checks. We found out these details and more when the office manager was out sick in the hospital for more than 3 weeks. I actually received an emergency call to help in the office because no one knew what to do or had access to payroll, access codes, and files.
Based on your knowledge of the six principles of the various control activities, what would recommend to my clients?