It's a trite expression that you hear often enough. It's often dismissed out of hand. But when it comes to compliance and IT, it's not a question that management, or worse, auditors, will excuse lightly.
Often times, the answers you need, the answer to this question is hidden in the data created by the systems and programs themselves. Releasing that information and interpreting it can be difficult and time consuming. You have to know each program, each systems intricacies. How and where they store the data, how to transalte it into something human readable is the challenge that IT faces when being asked the question (or preparing for an audit). Sometimes, you'd need some sort of time machine to set auditing levels appropriately to collect the right data - in this case there isn't much you can do, other than set it up properly and be prepared for the next set of questions.
Collecting that data, while it may be no simple task, is the easy part of the equation. The majority of the work in this chore is interpreting or translating the data into something you can not just understand, but present to others (up the chain or out to an auditor). Some programs may have a "User" field, others might have "contact", "responsible party" or even "username". Normalizing the data is a lot of work. It's probably the task that most people dont' think too much about when they get asked "who knew" about changes made to your environments.
The good news is that there are products out there, like Quest Change Auditor that collect and normalize the data automatically from a wide variety of Microsoft Windows platforms and programs. They can help you answer this question (and so many more). ChangeAuditor users love the simple interface because it gets you to answers fast. When was a change made, who made the change, what exactly was changed, what was it previously, from where did the change initiate... all questions that are pretty common. I'm sure you've either asked these yourself, or been asked them by others. Having something that gathers and normalizes the data, with a simple, human understandable interface to present that data is the difference between a few clicks and days or weeks worth of work, depending on the complexity of the question and how you're expected to present your results. That's why our users love ChangeAuditor.
Well, now you do!