Best Practice for Creating IT Support Roles

Summary:

Looking for feedback on the best way to create IT support roles in a production environment that is subject to SOX audit.

Content (required):

Our team continues to struggle with access related to the IT group that supports the application. We are challenged with providing the right access for them on a daily basis while separating what should be given only on an as needed basis without overburdening the teams with red tape. We have attempted to create custom roles by function, but we still find that we run into issues with permissions and data access issues even though they may be there. We also struggle with the fact that Oracle has provided no way to give read access to the