Audit Trail

An audit trail records events, one entry per event, in the order they happened. An event is anything a person or a system did to a file or an account: a login, a view, a download, an edit, an approval, a signature, a change of permissions, a deletion.

Every entry holds the same parts, so entries can be sorted, searched and compared. The table shows the parts a useful entry holds and the question each one answers.

The last row is the one most often absent. Without it, a reader cannot tell a complete trail from one with entries removed.

An audit trail is not a summary written afterwards. A file note saying that the client approved the draft on Tuesday is a statement by its author. An audit trail entry for the same approval is made by the system at the moment the client pressed the button.

An audit trail is reliable when a person who was not there can depend on it without taking anyone's word. Five properties decide that.

It is complete. Every relevant event is recorded, including refused actions, and logging cannot be switched off for one user or one file. It is written by the system. No user chooses whether an entry is made. It is tamper-evident. Entries cannot be edited or deleted, and a change made behind the interface would show. Its clock is independent of the people it records.

The fifth property is the one most often missing: the actor has to be a known person. An entry that says an email address opened a file proves that someone with access to that mailbox or password did so. Whether that was the client depends on how the account was created and how each login is protected.

EU law describes these qualities in one place. Article 3(52) of the eIDAS Regulation defines an electronic ledger as a sequence of electronic data records that ensures the integrity of those records and the accuracy of their chronological ordering. A qualified electronic ledger must also establish the origin of each record and make any later change immediately detectable (Article 45l). Few audit trails are qualified ledgers, and none has to be. The list is still a fair test for any trail.

A trail that falls short remains usable. An electronic document cannot be refused as evidence solely because it is electronic (Article 46). How much weight it carries is for the court or the supervisor to decide.

No EU regulation tells a law firm or an accounting practice to keep something called an audit trail. Several rules set duties that are hard to meet without one, since each asks the firm to show afterwards what it did.

The Anti-Money Laundering Regulation applies from 10 July 2027. Under Article 21(3), obliged entities must keep a record of the actions taken to comply with customer due diligence, including the decisions taken and the supporting documents and justifications. Article 20(4) requires them to be able at all times to demonstrate to their supervisors that the measures taken are appropriate to the risks identified. Article 77(1) requires them to retain a copy of the documents and information obtained in customer due diligence. Article 78 requires systems that let the firm respond fully and speedily to enquiries from the financial intelligence unit or other competent authorities.

The GDPR takes the same approach to personal data. The controller is responsible for the data protection principles and must be able to demonstrate compliance with them (Article 5(2)). It must implement technical and organisational measures to ensure, and to be able to demonstrate, that processing follows the regulation (Article 24(1)). It must document every personal data breach, with the facts, the effects and the remedial action taken (Article 33(5)). One risk the security rule names is unauthorised disclosure of, or access to, personal data (Article 32(2)). A firm that keeps no record of access has no means of telling whether that happened.

None of these provisions says how the record must be kept. A paper file with dated notes can meet them. An audit trail produces the same evidence as a by-product of the work, with no reliance on anyone remembering to write it down.

They add proof that does not depend on the system that produced the trail. An ordinary audit trail is a record kept by the firm or by its software supplier. If the other side disputes the log, the firm has to show that the system was sound.

A qualified electronic signature moves part of the evidence into the document itself. It has the equivalent legal effect of a handwritten signature (Article 25(2) of the eIDAS Regulation). It is capable of identifying the signatory, and it is linked to the signed data in such a way that any later change is detectable (Article 26). The certificate behind it comes from a qualified trust service provider, which must verify the identity of the person it issues the certificate to (Article 24(1)). Anyone holding the file can validate the signature without access to the firm's system.

A qualified electronic time stamp does the same for time. It enjoys a presumption of the accuracy of the date and time it indicates and of the integrity of the data to which they are bound (Article 41(2)). Its time source is linked to Coordinated Universal Time (Article 42(1)). A party who disputes the time has to rebut the presumption. The firm does not have to prove that its own clock was right.

Both have a narrow reach. They cover the event they are attached to, which is normally the signing. They say nothing about who viewed the draft, who downloaded the annex or who changed the permissions. The trail still has to carry those events. The qualified signature and time stamp fix its most important points in a form that an outsider can check.

Keep it for as long as the record it supports, and no longer.

For customer due diligence records, Article 77(3) of the Anti-Money Laundering Regulation sets the period at five years. It runs from the end of the business relationship, from the date of an occasional transaction, or from the date the firm refused to act. Personal data must be deleted when the period expires, unless another EU or national law sets a different retention period. A competent authority may require further retention in a single case, for no more than five more years.

The trail itself contains personal data: names, email addresses, network addresses, times of activity. The storage limitation principle applies to it. Personal data may be kept in a form that permits identification for no longer than is necessary for the purpose (Article 5(1)(e) of the GDPR). National rules on professional files, tax records and limitation periods can set longer periods than five years, and they differ by country and by profession.

Two practical points follow. The retention period should be set per matter, not left to a software default, since some services keep activity records for a much shorter time than the documents. The trail also has to survive a change of supplier. A processor must delete or return all personal data at the end of the service, at the controller's choice (Article 28(3)(g)). A firm that asks for return should confirm that the audit trail comes back with the documents, in a format that can be read without the original software.

Every common way of working leaves a gap, including the systems sold as the answer. The gaps differ by tool.

Email produces no single record. Each party holds its own copy of each message, in its own mailbox, under its own retention settings. A sent message shows that it left. It does not reliably show that it arrived, that it was opened, or who opened it.

A shared drive records activity by account. How much is recorded and for how long depends on the service and its settings. A file shared by an open link can be opened by anyone who holds the link, so the entry names no one.

A signing service usually attaches a completion record to the signed document. That record covers the signing ceremony and nothing either side of it. The signer is commonly identified by an email address. The record is also the service's own statement, unless the signature itself is one that can be validated independently.

A client portal or client workspace keeps one trail for everything that happens inside it. That is its strength, and it has three limits. The trail stops at the edge of the system: a downloaded file, a telephone call or a decision taken in a meeting is not in it. The record is held by the supplier, so the firm depends on being able to export it. Where the portal verifies each user's identity at sign-up, later entries are only as strong as the login that connects each session to that verified person.

No tool records judgment. A trail can show that a risk assessment was opened and approved. The reasons for the decision still have to be written down by the person who made it.