What it means
An audit trail helps reconstruct who or what requested an action, which resource was affected, when it happened, and what the system observed. Useful records include stable identities, action and target identifiers, outcome, and relevant approval or correlation references. The trail should be protected from unauthorized modification and retained for its intended investigative or assurance purpose. It is still evidence with limits: clocks can differ, events can be missing, and a recorded account may have been compromised. A trail rarely proves a human's intent by itself.
The idea at a glance / Evidence
Keep a record another person can follow.
Three retained records link an approval, a start, and a reported result for one job.
Illustrative test on 2026-09-29; UTC clocks are synchronized. Job TEST-7 links three selected records. MAINT-88 is the approval reference, not proof of who used an account.
READ THE PICTURE
Reconstruct the selected history
Three retained records share job TEST-7: approval, start, and a reported 200-record result. Read them together to reconstruct this selected history. Accounts and timestamps still need context; earlier records stay available for review.
Keep in mindThis selected history does not establish completeness, a human operator, or immunity to tampering. Verify source clocks, collection coverage, access controls, retention, and record integrity.
Read the complete example
- Reconstruct the selected history. Three retained records share job TEST-7: approval, start, and a reported 200-record result. Read them together to reconstruct this selected history. Accounts and timestamps still need context; earlier records stay available for review. On 2026-09-29, three retained observations share job TEST-7. ApprovalApp record A40 at 02:00:00 UTC identifies approver account Supervisor and approval MAINT-88 for 200 TestDB records. Scheduler record A41 at 02:05:00 UTC identifies execution account Ops, start of TEST-7, and reference MAINT-88. TestDB record E42 at 02:06:00 UTC identifies Ops and reports TEST-7 completed with 200 records. The selected records stay separate; later entries do not overwrite earlier ones. The clocks are assumed synchronized for this test. Correlation reconstructs this selected history without proving that every event was captured, identifying a human operator, or making the stored history tamper-proof.
This selected history does not establish completeness, a human operator, or immunity to tampering. Verify source clocks, collection coverage, access controls, retention, and record integrity.
Diagram references: NIST SP 800-92: Log generation, transmission, and storage · OWASP: Logging event attributes and protection
AN ILLUSTRATIVE SCENARIO
A payroll permission changes
A council investigates why an employee could export payroll data. Its audit trail links the permission change to an administrator account, the requested role, a recorded approval, and a time. Application logs show when the permission became effective. Investigators compare the records with the administrator's authentication history and interview the approver. The trail supports a reconstruction, but a shared account or missing interval would weaken attribution. The team explicitly records those gaps instead of presenting the timeline as complete.
Put it to work
- Identify the actions that need accountability, such as permission changes, sensitive exports, and response actions. Define required fields and protect personal or sensitive data from unnecessary collection.
- Send records to a controlled destination with appropriate access, time synchronization, retention, and integrity protection. Separate administrative authority where feasible and alert when collection stops or records are unexpectedly altered.
- Connect related events using stable request or case identifiers. Document clock sources, collection delays, and known omissions so a reviewer can distinguish an observation from an assumption.
How to check your work
Perform a permitted test change and reconstruct it from request through approval to actual effect. Confirm the record reaches the protected store, ordinary administrators cannot silently change it, and a simulated collection interruption becomes visible.
Connect the ideas
- Log
A record emitted by a system that something happened, which may later be used as evidence.
- Evidence
A record you are willing to cite in a decision, with enough provenance to explain what it can prove.
- Non-repudiation
Evidence supporting a claim that a particular party originated or approved something, so a later denial can be evaluated. Reliable identity binding and record integrity matter.
- Data minimization
Collecting, using, and keeping only the personal information a stated purpose needs, and no longer than that purpose requires.