I am looking for any input on how you are monitoring your employee's with the Customer Admin role. I am aware of the audit logs, but these seem to be quite limited to role changes and do not seem to track changes to global or system settings. Our monitoring activities would be really focused around SOX and SOD issues as well as DCAA requirements.
Since the CA can basically configure the entire system, it presents some significant challenges in monitoring. I would appreciate an insight that could be provided on various monitoring activities that you have deployed.
Are there some less powerful roles that I might have missed that can be used to administer the system?