I agree with your SOX separation of duties setup and monitoring interpretations.  What have you done to monitor the activities of your individuals who have the capability to alter the production schema (such as your 'migration specialists')?  Do you have a process built to report any  'DBA' type activities in the Production environment?