There needs to be some separation between configuring the system and auditing it. If you could only push configs through something like rancid, made it read on

There needs to be some separation between configuring the system and auditing it. If you could only push configs through something like rancid, made it read only to auditors or users, and could ensure configs only could get pushed through that, it would be reasonably to trust it. It is hard when anyone can either bypass config management to add logging, or where the audit doesn't include all systems in scope, or is only done yearly (so bad stuff can happen in between).