JDE Security Organizational Placement

Hi JDEListers,
A non technical question for the techies please.
Where in your company do the people that maintain JDE security report organizationally? IT or some Business group? Are they also your CNC people or do you have business involvement.
If they are your CNC people how do you manage controls to ensure that the CNC people are not granting themselves inappropriate access? Or doing inappropriate actions (ie creating payments for themselves).

Thanks for you help and I hope to see many of you at Collaborate13 in Denver.

Sue Shaw
E1 9.0 Update 2/Tools 9.1

Sue,

We are a small shop and as such we don't have the ideal separation of duties. In practice an administration area (not IT or faculty - this is a University) looks after JDE security. However, The IT area resource (me) covers all bases, including security backup/problem resolution, CNC, Development, production issue resolution. Our Production system (a single pathcode) is a completely separate installation to our development and test system (3 pathcodes, including pristine).

The major tables (including security tables) have database triggers, tracking record changes, insertions and deletions.