what changes has the admin made

Hello Marc,

Thank you for contacting the Sophos Community!

You can find this information in the Live Log viewer.

You need to filter by Admin

Regards,

THX

I found that something has been changed in the routing, but unfortunately not what.

then I found out that the daily backups are made locally.
sophos doesn't tell me how to get to them, or how to restore them.
I want my UTM back!

Hello Marc,

For the backups, please check this link.

Also if you sync your XG with Sophos Central, you will be able to find the Backups there.

Regards,

The future of change control will be included in Central. As Central will be some sort of management platform, the auditing of a firewall could take place in Central. So the focus is of course on the central management platform. 

Its not there yet, but the first steps are made in Central to move towards a better visibility. 

Speaking about change control: This is always a good idea to limit the configuration administrators to "as few as possible" - Not over committing in granting accounts to everybody to leave the configuration only to those peope, which document the change and know, what impact a change will do.