[verandaguy_alt]

What most companies have is access controlled by an organizational superuser team.

At large companies, this means that each team has full or near-full control over their "jurisdiction." IT has full control over LDAP accounts, and since they're a team, one person going AWOL won't affect the org as a whole. There are also infra teams that control domain routing and hosting providers.

[walshemj]

The way we used to do it in our bit of BT was for passwords to be limited and to be written down put in an envelope and stored in the fire safe.