Google's APIs make it easy to audit your groups, and if you don't want to write your own program to do it you can use the GAM command line tool. https://github.com/jay0lee/GAM/wiki
Here's roughly what that looks like to get all the mentioned info out:
function getGroups(domain) {
var groups = [], pageToken, page;
do {
page = AdminDirectory.Groups.list({
domain: domain,
maxResults: 100,
pageToken: pageToken
});
if (page.groups && page.groups.length > 0) {
groups = groups.concat(page.groups);
}
pageToken = page.nextPageToken;
} while (pageToken);
return groups;
}
function getGroupPerms(groups) {
var perms = [];
for (var i = 0; i < groups.length; i++) {
perms.push(AdminGroupsSettings.Groups.get(groups[i].email));
}
return perms;
}
The huge benefit to GAS IMO is that creds never hit my disk.
I'm guessing this is a feature? As in Google wants it to be easy to just create local sheets/docs/... without them being shared with your org by default and would rather worry about giving admins better features to manage and audit sharing than give admins access to every document under the sun :)