Blindly installing updates (even
freebsd-update updates) can be a Bad Thing: One option in
rc.conf changes, and suddenly your machine has no SSH daemon anymore.
Similarly you probably don't want to blindly install all available port updates via
portupgrade -a -- you might take a major version number bump and break the universe, or you might just have a port with new configuration options that need to be changed (you can make ports just accept whatever their defaults are, but sometimes that's not what you want).
The best way to do this is to use a configuration management tool like Puppet or radmind to deploy your changes.
Make a machine template based on a box you've successfully upgraded and tested, then deploy that to the rest of your environment. This ensures that you're pushing out a working system configuration, and that you only have to do the manual steps once (on the machine you're templating from).