Just start the ConfigMgr console, and go to the Monitoring tab. There choose System Status > Status Message Queries. There you will find 41 queries, based on: auditing, boundaries, collections, deployments, packages, programs, remote control activity, security roles, server components and site systems. Lot to find there :-)
Recently it was needed to audit changes, which were found in audit messages. One for the site and for a specific user. Those will tell you who did what and when:
All Audit Status Messages for a Specific User: Audit status messages that track activity initiated by a specific user (when prompted, use the form DOMAIN\username).
All Audit Status Messages from a Specific Site: Audit status messages reported at a specific site.
When needed it's good to know that this functionality is built-in the console. Hope it helps!
Source: Microsoft TechNet