The Only Constant in Modern Infrastructure, is Change (opens in new tab)

...the audit log should also tell you what happened, when it happened, and who set that event into motion.