EPDM best practices include creating a test vault where you can try out new workflows, permissions, etc without disrupting normal user operations. The question is, how do you keep track of changes in your test vault vs. your real vault? The only methods I can think of are either diligently writing down every change you make or comparing each and every item in the admin tree from each vault side by side. These are both horrible, error prone options in my opinion. The obvious solution would be for SW to implement the idea put forth in SPR 647969:
"Need ability to replace existing workflow with new version that has the same name as old one when importing CEX file"
and actually expand it to all admin settings, not just workflows. So, go tell your VAR to add you to that SPR and then come back here and tell me how you are handling this difficult problem.