Reporting what a security group can see and do at field level

We've been in BAU mode for some months now, and our implementation partners have stepped away. I'm being asked to explain to Legal and Audit what each of our security groups can see (view) and do (edit) , within every process and on every field - eg our HR specialists can see date of birth, but can't edit it, or our Finance BPs can see and edit cost centres but can't see ethnicity.

Has anyone managed to configure something that can help me work this out - because we need to have something generated from the system to prove to Legal that we're protecting what we should, and while this was all tested for implementation, they require an ongoing check in on this and we need to give something they can get used to, that we're confident is extensive enough and makes sense ... I think it's something in the Privileges, but just not sure.