I have added logging of such access, via OE Auditing, in the past as a result of “auditor concerns”. Part of that also involved writing some reports to demonstrate compliance. Or at least report on when the access was used.
The work was done for a bank and I probably had to bill them for at...