Taking over an existing Drupal site On ServerFault, this question "Ending company IT Admin relationship" has a pretty good general checklist for taking over an existing IT system, but I'm wondering as it relates to Drupal:


What system access controls should I get, or confirm have been changed after the takeover?
What is the most effective way to assess the scope of existing custom configurations, development, etc done?


If it matters, the existing site is on Drupal 6, but talking about porting the site from 6 to 7 is beyond the scope of this question.
To save yourself access headaches:


Get credentials for the "user 1" account that has full Drupal access
Get database access or a copy of the most recent database
Get SSH Access to the production server


To audit the site once you get access:


Install http://drupal.org/project/hacked to make sure there haven't been any undocumented changes to Drupal core or contrib modules.
Look in /sites/all/modules/custom to find any custom modules. If nothing is there one good way to tell if you're missing any hidden ones is by looking at http://example.com/admin/build/modules and looking for modules without a version number. They may be hiding in /modules or /sites/*site_name*/modules.
Have a look at the theme and especially the contents of template.php. Often times a site will have a lot of modifications happening here.
After looking at the items found in #1, #2 and #3 you shouldn't expect to have found a whole lot. The custom modules should be mostly hook implementations and 'glue code' not re-inventing the wheel or re-creating functionality found in popular contrib modules but your mileage will vary here depending on how custom the site requirements originally were.