It used to be possible to create a copy of the Administrator role and just take out the things that weren't needed by IT, but that doesn't seem to be possible anymore.

There's a bundle you can use. See suiteanswer 75712