What it means
An audit trail helps reconstruct who or what requested an action, which resource was affected, when it happened, and what the system observed. Useful records include stable identities, action and target identifiers, outcome, and relevant approval or correlation references. The trail should be protected from unauthorized modification and retained for its intended investigative or assurance purpose. It is still evidence with limits: clocks can differ, events can be missing, and a recorded account may have been compromised. A trail rarely proves a human's intent by itself.
AN ILLUSTRATIVE SCENARIO
A payroll permission changes
A council investigates why an employee could export payroll data. Its audit trail links the permission change to an administrator account, the requested role, a recorded approval, and a time. Application logs show when the permission became effective. Investigators compare the records with the administrator's authentication history and interview the approver. The trail supports a reconstruction, but a shared account or missing interval would weaken attribution. The team explicitly records those gaps instead of presenting the timeline as complete.
Put it to work
- Identify the actions that need accountability, such as permission changes, sensitive exports, and response actions. Define required fields and protect personal or sensitive data from unnecessary collection.
- Send records to a controlled destination with appropriate access, time synchronization, retention, and integrity protection. Separate administrative authority where feasible and alert when collection stops or records are unexpectedly altered.
- Connect related events using stable request or case identifiers. Document clock sources, collection delays, and known omissions so a reviewer can distinguish an observation from an assumption.
How to check your work
Perform a permitted test change and reconstruct it from request through approval to actual effect. Confirm the record reaches the protected store, ordinary administrators cannot silently change it, and a simulated collection interruption becomes visible.
Connect the ideas
- Log
A record emitted by a system that something happened, which may later be used as evidence.
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Non-repudiation
Evidence supporting a claim that a particular party originated or approved something, so a later denial can be evaluated. Reliable identity binding and record integrity matter.