Every platform keeps receipts. You just have to look: Google Ads change history (every edit, dated, by whom), your CMS revision logs, Search Console for what got indexed when, email platform send logs. An hour in change histories tells you more than a year of reports.
Read for cadence, not volume: steady weekly activity (search-term pruning, tests, content) is a managed account; a flurry the week before your review call is theater. Cross-check the invoice line-items against the evidence trail.
If access to these histories is something you have to request. That's the finding. The audit's deeper purpose is confirming you can SEE your own operation; opacity is a result too.