@Boricua That's what I thought too, but the correct answer is C
Here's the explanation:
Properly designed control activities should include proper controls over segregation of duties. Examples of specific control activities include authorization, performance reviews, information processing, physical controls, and segregation of duties. In order to have a proper segregation of duties, one should not have the ability to perform multiple control activities.
In this instance, a payroll department supervisor would have controls over the information processing. Giving this person authorization controls violates the segregation of duties control activity.