audit trail
/ˈɔː.dɪt treɪl/noun
An audit trail is a chronological record of actions and changes in a system. It shows who or what performed an action, when it happened and what changed.
The audit trail showed which administrator had changed the access permissions.
An audit trail consists of events recorded chronologically in software. When a change occurs, the system might record the time, the user or automated task, the action performed and the affected data. It may also store the old and new values, the result of the action and a reason for the change.
How does an audit trail differ from logging?
Glossary · In briefloggingLogging records events while software is running. These records help developers follow a system's behaviour and investigate problems.Read more can collect many kinds of technical information, such as error messages, response times and system statuses. An audit trail contains a deliberate selection of events needed to reconstruct actions and identify who performed them. An ordinary log file is therefore not automatically an audit trail.
A useful audit trail must be complete enough for its purpose. Consistent user and object identifiers, reliable timestamps and a fixed structure make events easier to connect. Records must also be protected against unauthorized changes or deletion. How long data may or must be retained depends on its purpose, its sensitivity and any rules that apply to the organization.
What is an audit trail used for?
Organizations use audit trails for audits, security investigations and resolving disputes. In an administrative system, they can reveal who approved a payment. In a healthcare application, they can show who viewed or changed a record. During a security incident, the sequence of events helps establish what happened.
An audit trail alone does not prove that an action was correct or permitted. The record must be considered alongside policies, user permissions and other system information. An audit trail should also record only the data needed for its stated purpose.