At a business roughly the size of the one OP is talking about, we shared the password with a small group of people and kept a hardware two factor authentication device locked behind a door accessible only to a different small group of people. The basic idea is that you'd need both someone with the password (usually technical leads) and someone with access to a secret spot in the office (generally someone in finance/accounting) to log in, and locking anyone out of the office would instantly ensure they had no access.

I don't think a solution like this works directly for the specific situation that OP describes, but I do think it's a good solution for an AWS root account at an organization of the size he is talking about.