ACI Dealing Certificate (#13)

Regarding access to production systems, which of the following is incorrect?

Profiles for functions are encouraged and should be reviewed semi-annually by a manager.
Developers should have unrestricted access to production systems.
Access to production systems should be rigorously controlled.
Users should not have access to change system functionalities.