At a mid-sized company, one accounts payable clerk is able to both create new vendor records and approve payments to those vendors. During an audit, this is flagged as a control weakness because the same person could create a fake vendor and pay it. Which access control principle should be implemented to correct this?