A controller of an information handling system (IHS) performs a method to detect tampering with functional components of IHS. Following a last authorized configuration change of locally-available information handling resources, a unique code is generated and stored with a time-stamped system log entry in a system memory. Prior to transit, a system management audit (SMA) log snapshot is generated and provided to an audit device for separately conveying to a recipient of the IHS. In response to powering up at least the controller of the IHS after transit, a current SMA log snapshot is obtained that includes a current SMA log entry and a current unique code. Access by an audit device is provided to the current SMA log snapshot to enable comparison to the SMA log snapshot created prior to transit for identifying whether there has been tampering with the IHS.