An open-ended question.
A – Do you have a standard hardware template/checklist?
B – Do you have a standard software template/checklist?
C – Do you have a standard permissions by group template/shecklist?
D – Do have written policies for exceptions to those standard provisioning templates?
E – Do you have a database of equipment/software provided to the user noting exceptions to the standards?
Can you see how I developed my system? I will tell up front the hardest fight and the most important part is ‘D’.
Without written policies approved by admin then the exceptions are driven by politics not need of the business. If you cannot control exceptions then ‘change notifications’ become a record of the loss of control and the ability to manage you network.
Good luck – you will need it.