It's not about it being private - clearly the business can have root/admin/domainadmin/whatever access. However your username and password identifies you. If u

It's not about it being private - clearly the business can have root/admin/domainadmin/whatever access. However your username and password identifies you. If user "johnsmith" does something, then that's because johnsmith has logged in. Now IT may have changed the password to allow them to log in as johnsmith (either following some odd policy, or a rogue IT worker), but that would be in the audit log. If a company needs more than one person accessing an account for some reason, they should create a generic account (e.g. "z_reception" for a generic reception machine).