Audit Trail
An audit trail is a chronological, immutable record of all activities, changes, and decisions within a system. In governance, it provides the evidence that activities were performed, decisions were made, and controls were operating — enabling reconstruction of events for audits, regulatory examinations, and internal reviews.
A governance audit trail captures: who performed the action (user identity), what was done (action type — create, update, delete, approve), when it happened (timestamp), what changed (before and after values), why it was done (reason), and where (system, module, entity). Audit trails serve three purposes: evidence (proving activities were performed), accountability (identifying who did what), and detection (identifying unusual or unauthorized activities). In a well-designed system, audit trails are system-generated and cannot be modified by users.
Examples
- •A policy approval audit trail shows that the policy was drafted by User A, reviewed by User B, and approved by User C on specific dates with documented rationale.
- •A vendor onboarding audit trail shows the DDQ was sent, responses received, risk assessment completed, and onboarding decision made — with all timestamps and user identities.
- •A compliance finding audit trail shows the finding was identified, assigned, remediated, and validated — with evidence at each stage.