What do you do when...??

Sometimes you find yourself in one of those situations, where the customer calls you and wants to know:

• Who copied or modified a file, or
• Who created or modified a user account
  

When you get on-site, you find that the system in question had no auditing enabled, that the admins use a group account (and they all use the password) for administration functions, and that there are simply no protections in place at all.

So, what do you do? After all, if it wasn't important, the customer wouldn't have called you, right? What do you tell them?