OPS$ /identified externally accounts and PCI/SOX/SAS

 I'm looking for some docs that could help my security folks / teams  understand externally identified accounts. The problem is we are using  various text files to store passwords to perform server based tasks . and some of those tasks i feel can be automated and password files cleaned up using externally identified accounts for specific accounts that are su only and audited on the database and the OS level. I'm looking at what people have seen in terms of security for PCI/SOX & SAS70 .
I know i have change the prefix and ensure remote_os_authentication to false to ensure it stays in the box only.  This si going to be UNIX only and only jobs that are run via cron so no external access out of the server.