When SOX compliance became a thing (remember Sarbannes-Oxley?), many moons ago, I was able to send EY consultants away during their audit for Unix controls, just by showing them that all our (Autodesk Unix team) configs were in SVN, logged, with authors and full change control.
The Windows team had to spend months figuring out something that was not even remotely close to control or auditability.
Frankly, I just assumed that it was the std practice today and I am surprised people are still not doing it.
