In rare instances, an administrator is caught doing harm and is consequently terminated. When this happens, all of the administrator's past actions come into question and need to be reviewed carefully. This is a forensic audits. Without special technology deployed in advance, forensic audits can be quite difficult to carry out and will only yield limited results.
Using Privileged Access Manager, administrator actions can be recorded, archived and played back, creating detailed accountability.