HFM Admin Segregation of Duties

We are constantly challenged by audit regarding our HFM admin’s access. 

Has anyone see a company who has split these duties or have suggestions how to accomplish this?

Specific challenge is allowing the admin enough access to perform their job: maintenance of metadata, data loads, consolidating data, etc.

at the same time restricting more sensitive changes such as rules or creation of applications.

If resourcing was not constrained, which it always is, does the product provide sufficient diversity of roles to achieve this?

Security is another sensitive area that the HFM admin manages. 

This could be done through removal of provisioning manager role and training of a backup resource.