We have a ban on modules we can't receive from Debian's package manager, so I take the CPAN module and drop it into my project. Now it's no longer a CPAN module :) I work on projects used internally, so the license is not an issue.
This way, we test against the same version of the module that ends up being used. It also gives us the ability to make and track changes to it, if need be.
This sounds like a good, simple solution, but isn't it a bit of a problem that the CPAN module can't receive any updates unless you decide to apply them? It takes the process of doing updates out of the domain of the sysadmin's and leaves them up to the programmers.