I agree that is not the way to do it (in general, not specifically for Solaris). You need to create (or use) some sort of baseline, either locally or somewhere else that is the same for development, test, qa and production, otherwise (because these environments should be patched in a certain order and never at the same time) there will be all sorts of differences between environments or perhaps even between different hosts within the same environment, depending on the moment of update. Ideally there are some extra unused hosts that can be tested prior to dev or test environments.

There also needs to be a distinction between preventive and corrective patching and patches need to be tested first. I personally am not of the school of "don't fix if it ain't broken", I think regular patching is a necessity. Security patches should be treated differently (perhaps also with a different frequency) from ordinary patching, especially if hosts are directly of indirectly exposed to the Internet. Besides OS, also applications (and their patching) need to be taken into account.

At any rate there should also be a good roll-back mechanism in place, simply removing a patch is often not sufficient to return to a previous state if need be..