Yes everything needs to be tracked and no changes can be implemented by the developer per our SOX auditor. The developer makes the changes and documents it then sets it up in a test enviornment for the users to test. Once testing passes the change must be handed off to a "migration specialist" whom will be responsible for making the change to the production serves. Change in security, adding new users, etc all needs to be tracked and audited. We are a small shop and still figuring out how to create all then new hats since we are not allowed to wear hats in both the production and developer worlds.

Mike