How to define the Task under the Setup and Maintenance is a config item or regular maintenance

Summary:

How can we distinguish whether the Task under the Setup and Maintenance is a configuration item or regular maintenance

Content (please ensure you mask any confidential information):

We are facing scrutiny from an audit firm regarding how to identify which Oracle changes should fall under IT change control management. We also been asked to provide evidence that business users are not granted system configuration-related permissions.

Our initial approach was to manage this through the Oracle "Setup and Maintenance" grouping—under which business users should not have access to any Tasks of Setup and Maintenance. Therefore, any changes made by business users within the system could be assumed to be part of routine business processing and would not require IT change review.