There is and always will be a struggle to balance usability and security. This core question you are asking above is a much discussed and contentious topic.
In the realm of SOX compliance it comes up quite a bit. One of these days someone will write the definitive blog post on this topic and no one will agree with them.
I am not a fan of Accounting folks controlling the SA and DYNSA user accounts. Especially in large companies, where a segregation of duties and compliance come into play. I believe, technical folks in IT should control them. They should also track and audit their use and a log should be maintained describing the explicit purpose of the use of the SA account in any instance it is used.
Very few people need or should have this kind of power.
Within the IT group, team members must train on Dynamics GP administration, and be ready to support tasks like backing up and restoring databases, creating test databases, provisioning and retiring databases and users, making changes using Professional Services Tools Library (PSTL), which require the use of administrator accounts.
For instance, IT folks should know that GP does not support a SA password greater than 15 characters long. Only the SA account password can be changed using SQL and still function in GP because of password encryption inherent to GP... If these things are news to you, then you need to go to school on GP Administration, especially if you want to recommend or insist you be tasked to support it, which is what it sounds like you are recommending.
Make no mistake, GP contains your corporations financial, HR and Payroll data, SOX and PCI compliance are not the only concern here. Damage to the system, leaks about pay rates, disciplinary actions and medical conditions are just a few considerations outside the scope of SOX and PCI compliance.
IT also needs to be able to provide the level of service expected by users - instant gratification is a must, within the scope of reasonable controls.
It is also worth noting there are 3rd party applications, which absolutely require the SA password to perform administrative tasks.
Finally, it is my professional opinion that the POWERUSER security role cannot be used when SOX compliance is necessary. The POWERUSER role is not the permission to do everything within Dynamics GP, it is literally the absence of any security control or reporting on users who have this Role assigned. It is best used in small companies with no segregation of duties when one or more users perform all tasks in GP.
I agree with the premise, IT should control the sa and DYNSA users and manage the tasks these users are required to perform. Especially in large companies, where compliance is a consideration. But be careful what you wish for, you just might get it.
Hope this helps.
