Regarding access to production systems, which of the following is incorrect?

Profiles for functions are encouraged and should be reviewed semi-annually by a manager.

Developers should have unrestricted access to production systems.

Access to production systems should be rigorously controlled.

Users should not have access to change system functionalities.