Glossary
What is an audit trail
The record of who did what and when, which cannot be rewritten.
Audit trail
The sequential record of actions taken on a system — who, what, when — stored so that it cannot be altered afterwards.
What makes it worth something is that last part. A log the administrator could retouch would prove nothing, because the administrator is precisely who would have reason to retouch it.
What it is for, in practice
| Situation | What it answers |
|---|---|
| An external audit | That controls were genuinely applied, not just written down |
| A dispute | What was done, in what order and when |
| Improper access | Who signed in, from where and what they looked at |
| An internal error | What changed and who changed it |
Important
Once a dispute is live, do not reorganise or modify what it touches. Everything is logged, and a change made after the dispute always reads in the worst possible way, however innocent.
Worth knowing
An audit trail is no substitute for looking at it. It always exists; the value appears when someone reviews it occasionally, or when something has to be answered.
›Can an entry be deleted?
No. That is what makes it useful.
›How long is it kept?
According to your retention policy.
›Can everyone see it?
No. It is sensitive information about the people on your team.
A real case
The situation
An auditor asks how you guarantee documentation was checked before granting site access.
What you do
- Is shown the audit trail of several cases
What you get
They see approvals with their author and time, and the control stops being a claim and becomes evidence.
The situation
Somebody claims they reviewed a document and there is no record.
What you do
- Checks that file's audit trail
What you get
What was done has an author and a time.
The situation
You want to know who granted a third party access.
What you do
- Looks up the action in the log
What you get
Granting access stops being anonymous.
The situation
A figure appears changed and nobody knows who touched it.
What you do
- Checks the figure's own history
What you get
The change has a date and someone responsible.
The situation
An auditor asks for evidence of a control, not its description.
What you do
- Shows them the log of several real operations
What you get
The control moves from assertion to evidence.
The situation
There is concern that someone could rewrite the log.
What you do
- Verifies that entries cannot be edited
What you get
The log's value lies in nobody being able to correct it afterwards.
This article answers
- what is an audit trail
- audit trail meaning
- tamper-evident action log
- user action traceability