Changes to various settings should be collected in a log where they could be reviewed later on. Especially user rights changes and supplier information should leave a traceable log on who did which changes and when. The change log could be behind the user or supplier in question, as a general log with filters, or accessible through to reports.