Regarding access to production systems, which of the following is incorrect? 

Profiles for functions are encouraged and should be reviewed semi-annually by a manager. 

Developers should have unrestricted access to production systems. 

Access to production systems should be rigorously controlled. 

Users should not have access to change system functionalities.