In the past, I've considered installing tripwire or aide (see google) so that I could prove that a sys admin had modified something on a production system without proper notification. These tools might be used to handle SOX requirements.