You can set things up so there's no way for any single to bypass logs or other audit controls. A trivial way is to have all logins go via an administration host which logs separately , and never give admin rights on that machine to people with admin on the protected systems.
Yep. That's the way to do it. But a surprising number of companies have things set up so that a single individual can get at whatever data he or she wants without any logs or with logs that can be tampered with. Typical reason in small companies: there is only one person with the required skills.
What is surprising is that even the NSA did not follow these practices after all if there is a place where such a system would make sense it would be there, and they certainly could not make the excuse that they're small.
In the end someone or some process has access and a sysadmin / DBA could pretend to be that someone or that process.
Once you have physical access to a box it is game-over, the only thing that might still trip you up is an auditing system that is not part of that box.
You shouldn't make it easy either, but if someone configures a system they are in a position to bypass the security on that system. It all ends with trust.