Use your backup software to take another backup and list files changed. A long list, and there is no general purpose way to evaluate it. Perhaps spot check that security critical authentication configuration was not touched, and the installed software set is reasonable.
Your help should not have permissions to write to backup storage if not in the scope of work. Otherwise a malicious person could modify history.
Consider implementing centralized logging, also restricted access so it cannot be modified. syslog, possibly additional audit or application logging. Also large volume, so reading it all is not feasible. Yet having such logs secured enables reconstructing what happened if required.
Responsible people will understand these precautions as a part of principles like separation of duties. Audit trails and recovery systems are not to be tampered with.
An automation centered approach may reduce your dependence on how one host is configured. Deliverables could include scripts to do the requested tasks. Review the scripts, test them. Burn the test environment down and rebuild it, as if you really were compromised and needed to recover on clean installs.
