Choice "B" is correct. The requirement that employees take regular vacations is a good internal control, but it is unrelated to computer-access controls.
Choice "c" is incorrect. Using employee's names as their passwords is an ineffective computer-access control, because passwords are easily guessed.
Choice "d" is incorrect. It would be acceptable to assign employee names as passwords, as long as the employees were required to change their passwords at initial log-in as well as periodically in the future. The fact that this requirement is not in place is a limitation of the client's computer-access controls.
Choice "a" is incorrect. If password controls are used to segregate the duties of individual employees, using employee names as passwords allows an employee to circumvent this segregation by logging in with another employee's password.