applying security patches

Does anyone ever get any problems from users who don't want to apply the cpu patches? For example, we have users who don't want to apply them because:

1. the test system is different from the prod system (application-wise, not system-wise)
2. testers are busy on other things and can't take time to test the security changes
3. the prod system is in the middle of a critical process and no changes can be made for some time period sometimes up to 4 weeks.

Issue #1 concerns me and leads to the question of what type of testing do people require before installing the patch in prod.

I don't have a lot of sympathy for #2 since the patches are security related and have big implications if not applied.

Number 3 is also valid. Not sure what to do about this.

Comments appreciated.

Joe

--
http://www.freelists.org/webpage/oracle-l