We have SCCM control patch/update management. They are all (or should be) applied in the test and cert domains before release to production. Doing otherwise is a recipe for disaster.