A few different options, as I don't know of a feature in NCM that can do it:
1) Trigger a download of the config when you receive a SYS-5-CONFIG trap.
2) Configure accounting on a tacacs+ server and generate reports from there
3) Use syslog to log config mode commands:
archive
log config
logging enable
notify syslog
hidekeys
Source: Log configuration commands entered on your Cisco router « ipSpace.net by @ioshints
