What operations should be performed as SYS

Have any of you had to define (for SOX or otherwise) what specific
operations should be performed by SYS versus other administrative
operations that can be performed by a user granted DBA privilege?  If
so, are you willing to share?
(Help me!  The auditor is on my tail. mayday mayday)

Here's a list I came up with from the Database Administrator's Guide. 
However, I'm not too happy with it.  Any additions/changes would sure
be helpful.
Thanks!
Barb

Perform startup and shutdown operations
Alter database:  open, mount, back up, or change character set
Create database
Create or modify init or spfile
Alter database commands
Archivelog and recovery commands
--
http://www.freelists.org/webpage/oracle-l

Other related posts: