What operations should be performed as SYS

Have any of you had to define (for SOX or otherwise) what specific operations should be performed by SYS versus other administrative operations that can be performed by a user granted DBA privilege? If so, are you willing to share?
(Help me! The auditor is on my tail. mayday mayday)

Here's a list I came up with from the Database Administrator's Guide. However, I'm not too happy with it. Any additions/changes would sure be helpful.
Thanks!
Barb

Perform startup and shutdown operations
Alter database: open, mount, back up, or change character set Create database
Create or modify init or spfile
Alter database commands
Archivelog and recovery commands

--
http://www.freelists.org/webpage/oracle-l