The fact that some users will have a huge level of access to company information is unavoidable as long as you also want someone to be able to support the complex multi-platform solutions that proliferate these days.

The trick is to know at all times who has access to which systems, at what level, and who granted them that access. Since most systems have their own logs or access databases (some general SQL or LDAP, others strange and unusual ;), one usually requires some specialist third party tool to generate such reports and notify the responsible managers automatically if something seems out of place.
It's near impossible to find a single identity and workflow management tool to cover all the bases, unfortunatly. Each company needs to evaluate its own needs individually.

The company I work for produces several such tools which of course, I think are the best ones for the job =)

The important thing is to understand that someone always needs access to sensitive data, all you can hope for is that your HR department did good screening and that the managers care enough to follow up on access rights regularly. All too often people retain rights when switching departments...

Anthony Whitehead
NordicEdge AB
http://www.nordicedge.se/