This question already has an answer here:
In order to protect systems from insider attacks, companies can apply policies restricting their access. In the case of an employee's termination, the IT department can disable their account before they receive the news to prevent potential damage by a disgruntled employee. In a large organisation, how should essential services be safeguarded against their administrators? Granted, hopefully someone in such a position would be responsible enough not to abuse it - but I'd think the system should be designed with protections in case.
In essence: if the IT department can control the access of regular employees, who controls the access of the IT department? And what damage mitigation methods are there if someone at the highest levels of privilege decides to cause havock?