It must be supported by auditing and reporting.
This is totally true and feasible in the enterprise. I work for a company that sells a product that aggregates all existing accounts, and then periodically sends out emails to managers saying, "Here's a list of accounts belonging to your team." The manager has to approve each one or revoke them. That way, there is accountability down the road if it turns out there were lingering accounts that shouldn't have been accessible or exploitable. Can also be used to certify the accounts on each remote application by the application "owner" or administrator.
These certifications are then reviewed by third-party auditors to validate their completeness. Several other vendors offer similar variations of this functionality.