Yep. That's the way to do it. But a surprising number of companies have things set up so that a single individual can get at whatever data he or she wants without any logs or with logs that can be tampered with. Typical reason in small companies: there is only one person with the required skills.

What is surprising is that even the NSA did not follow these practices after all if there is a place where such a system would make sense it would be there, and they certainly could not make the excuse that they're small.