That's only true by default Kstone.
You can configure your cisco routers to syslog configuration changes:
And here is a link to the instructions on how to do so.... This documentation has been moved - Configuration Change Notification and Logging [Support] - Cisco
Here's an example of the syslog messages you might get then...
1206: *Oct 25 20:22:35.811: %PARSER-5-CFGLOG_LOGGEDCMD: User:root logged command:no ip http server
1207: *Oct 25 20:22:52.943: %PARSER-5-CFGLOG_LOGGEDCMD: User:root logged command:no ip http authentication
1208: *Oct 25 20:23:16.167: %PARSER-5-CFGLOG_LOGGEDCMD: User:root logged command:no ip http timeout-policy