Security - SOX controls

Summary

SOX controls require separation of duties and reporting

Content

One of our SOX controls is that the person that administers the data loaded to our environment should not be the same person that is adding users to be able to access our environment and vice versa.  I can have a user that is the Domain Administrator – and he/she will be able to set up the users to get to our environments, but in order to actually assign a user to a security group, he/she will also need to be a System Administrator…is there a way to give someone access to JUST the Access Control screen?