RE: Special authority use ... Auditing

[Al Mac <macwheel99@xxxxxxxxxxx>]

Be sure to include time frame of annual events such as physical inventory, 
end year fiscal, auditor reports ... there may be some special needs that 
are not run on a regular basis.

I think
* SAVRST should only be needed by IT people involved in backup recovery 
operations, and conversions.  It is not needed for people who download 400 
reports into Excel or attach to e-mail.
* IO config similarly is only needed by IT people managing hardware connections
* We give most of our users access to the spool file reports of co-workers, 
because it is not unusual that one person in a department generates a 
report, and others need to view it, or reprint it.  This means that there 
is no such thing as a confidential report at our company, only some people 
who think some data is confidential.

Of course there is always vendor software / hardware that is a little brain 
dead in the Security dept.

> Actually what I'm trying to do is gain an understanding what processes
> in my shop require Special Authority... I was hoping to analyze the
> audit journal for the last few months to get this information