---
id: KB-GL-014
url: https://app.codecontract.io/help/glossary/what-is-an-audit-trail
idioma: en
categoria: glosario
subcategoria: cumplimiento
audiencia: usuario
nivel: intermedio
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-AD-004, KB-CF-003]
citadoPor: [KB-GL-017, KB-TZ-004, KB-TZ-005]
---

# What is an audit trail

_The record of who did what and when, which cannot be rewritten._

**Responde a:** what is an audit trail · audit trail meaning · tamper-evident action log · user action traceability

**Audit trail** — The sequential record of actions taken on a system — who, what, when — stored so that it cannot be altered afterwards.

What makes it worth something is that last part. A log the administrator could retouch would prove nothing, because the administrator is precisely who would have reason to retouch it.

## What it is for, in practice

| Situation | What it answers |
| --- | --- |
| An external audit | That controls were genuinely applied, not just written down |
| A dispute | What was done, in what order and when |
| Improper access | Who signed in, from where and what they looked at |
| An internal error | What changed and who changed it |

> [!IMPORTANT]
> Once a dispute is live, do not reorganise or modify what it touches. Everything is logged, and a change made after the dispute always reads in the worst possible way, however innocent.

> [!NOTE]
> An audit trail is no substitute for looking at it. It always exists; the value appears when someone reviews it occasionally, or when something has to be answered.

**Can an entry be deleted?**

No. That is what makes it useful.

**How long is it kept?**

According to your retention policy.

**Can everyone see it?**

No. It is sensitive information about the people on your team.

## Ejemplos

**An auditor asks how you guarantee documentation was checked before granting site access.**

- Is shown the audit trail of several cases

→ They see approvals with their author and time, and the control stops being a claim and becomes evidence.

**Somebody claims they reviewed a document and there is no record.**

- Checks that file's audit trail

→ What was done has an author and a time.

**You want to know who granted a third party access.**

- Looks up the action in the log

→ Granting access stops being anonymous.

**A figure appears changed and nobody knows who touched it.**

- Checks the figure's own history

→ The change has a date and someone responsible.

**An auditor asks for evidence of a control, not its description.**

- Shows them the log of several real operations

→ The control moves from assertion to evidence.

**There is concern that someone could rewrite the log.**

- Verifies that entries cannot be edited

→ The log's value lies in nobody being able to correct it afterwards.