Well... here is that awkward moment when I admit I didn't search enough and found an SNOTE that provides a fix.
The snote is http://service.sap.com/sap/support/notes/2016525 and addresses the specific issue regarding transaction SSO2 and getting warnings for entries in the ACL list.
I have applied the note... and will perform the walk of shame back to my desk.
Thanks 