System administration without production data access?

OK, I hear this all the time on the list: "Programmers should not have access
to production data (or even the production system)." This sounds great in
theory, but how does it work in practice? How is system administration handled
without "dedicated" system adminstrators versus developers? Assume a small
shop with two - three iSeries folks.

I can fill in some blanks, but what about others?
* Use source control to manage object moves from development to production.
* Use backup software such as Tivoli or BRMS.

How are the following handled in a "do not touch" production system?
* Applying PTFs or vendor software updates?
* Allowing third party vendors to "dial-in" and maintain their software?
* Duplication live production data for use in test/development, so the
development system feels "real"?
 
I've only worked in small shops thus far, but I understand the need for
segregated control. Our current internal auditors are clamoring for this, but
do not offer any advice on REAL system administration, only "you shouldn't be
able to do this, that, and those other things."

Thanks,
Loyd

--  
Mediocrity: It takes a lot less time and most people won't notice
the difference until it's too late. <http://www.despair.com/>
loyd@xxxxxxxxxxxxxx  ICQ#504581  http://www.blackrobes.net/