An audit trail is a chronological record of the actions taken on a transaction, document or system, detailed enough to reconstruct what happened from start to finish. NIST defines it as a chronological record that reconstructs and examines the sequence of activities surrounding an operation, procedure or event, from inception to result.
A useful audit trail records, for every action, who did it, what they did, when, and what changed (the value before and after), plus any comment or attachment that explains why.
Why it matters
Audit trails answer the questions that come up after the fact: who approved this payment, when the bank details changed, why the amount went up. They support financial audits and dispute resolution, and they are often the only way to spot fraud that a single approval would miss.
Example
An auditor questions an $18,500 supplier payment (illustrative). The trail shows the request, the manager's approval, the controller's approval, and a change to the supplier's bank details two days before payment by a user who does not normally edit suppliers. That last line is what needs investigating.
Common pitfalls
- Logs that can be edited or deleted by the same people whose actions they record.
- Approvals given outside the system, leaving gaps.
- Shared accounts, so the "who" is meaningless.
- Recording only the final state, not each change along the way.
- A trail that exists but cannot be exported when the auditor asks.
In Easyflow, every request keeps a timeline of who did what and when, hash chained so later tampering is detectable.