Audit log

What it means

An audit log records who did what in a system and when: a sign-in, a document opened, an amount changed on an invoice, a client list exported, a record deleted. It is stored so that an ordinary user can neither edit nor erase it.

The point is not watching people but being able to reconstruct events. When something does not add up - a document disappears, a bank account number on an invoice changes - the log is the only way to tell a slip from a legitimate correction or an attack.

An audit log is often confused with a technical log and with a backup. A technical log helps developers chase bugs, and a backup keeps content so it can be restored. The audit log answers a different question - who made a change and what was there before. A backup can bring back an earlier state, but it cannot tell you who changed it or when.

How it works in practice

In accounting and payroll systems the log is part of internal control and complements access control: permissions say who may do what, the log says what was actually done. In a GDPR incident the log is what a notification to the regulator is built on.

In practice you decide which events are recorded, how long they are kept and who may read them. Access to the log should sit with someone other than the person whose actions it records.

We also use the log for everyday client questions: why the balance for a closed month changed, who reposted a supplier invoice, when a document was uploaded. A correction of an accounting entry has to show what changed, who made it and when, and in the accounting software that trail is carried by the log. The answer then does not have to be pieced together from memory.

What to watch out for

A log nobody reads is just a file. It earns its keep once unusual events are reviewed on a schedule - bulk exports, access outside working hours, repeated failed sign-ins. The last of those is also the cue to switch on two-factor authentication.

Logs are often kept for too short a time. If the system purges entries after a few weeks, an incident discovered months later has no trail left. The log also holds personal data itself - names, IP addresses, sign-in times - and needs the same protection as the rest; unauthorised access to it is a personal data breach in its own right.