What Is an Audit Trail?
An audit trail is a chronological record documenting the history of a transaction or record: what was created or changed, who did it, when, and often what the value was before and after. It allows any figure in the financial statements to be traced back to the source document and the actions that produced it.
What an Audit Trail Must Capture
- Identity:
the specific named user, not a shared or generic account. - Timestamp:
date and time, ideally with time zone recorded. - Action:
what was done, such as created, edited, approved, deleted, or posted. - Record affected:
which transaction, invoice, or master record. - Before and after values:
the prior and new state for any change. - Supporting document:
a link to the underlying invoice, receipt, or contract.
Shared logins are the single most common weakness. A log showing 'ap_user' approved a payment establishes that the approval happened but not who is accountable for it, which is exactly what the record exists to answer.
An Audit Trail Through an Invoice
EXAMPLE
Invoice #4471, $9,000
Mar 3, 09:14: received by email, captured by system
Mar 3, 09:15: matched to PO #4471 and goods receipt, 30-unit variance flagged
Mar 4, 11:32: variance reviewed by J. Alvarez, short shipment confirmed
Mar 4, 11:35: debit memo raised, $540
Mar 4, 14:02: approved at $8,460 by M. Chen
Mar 5, 08:00: posted to ERP, period March
Mar 12, 16:41: paid by ACH, trace #88213
Mar 13, 07:20: payment reconciled to bank feed
Each step names a person or a system action and carries a time. An auditor asking why this supplier was paid $8,460 against a $9,000 invoice has the answer without needing to ask anyone.
The Audit Trail in QuickBooks
QuickBooks maintains an audit log recording changes to transactions, and it cannot be switched off in QuickBooks Online, which matters because it means users cannot quietly remove evidence of edits.
- QuickBooks Online:
the Audit Log under settings shows date, user, event, and the changed transaction, with filters by user and date range. - QuickBooks Desktop:
the Audit Trail report shows added, modified, and deleted transactions with prior values retained. - Deleted transactions:
remain visible in the log rather than disappearing, which is what makes it useful for investigating discrepancies.
The practical limitation is that the log captures what happened inside QuickBooks. Decisions taken before an entry reaches the system, such as an approval given over email or a variance resolved by phone, leave no trace unless they are separately documented.
Why Manual Processes Break the Trail
The gaps in most audit trails are not in the accounting system. They sit in the steps before it.
- Email approvals:
an approval in an inbox is not linked to the transaction it authorized. - Verbal resolutions:
a discrepancy settled by phone leaves no record of who decided what. - Spreadsheet workings:
calculations supporting an accrual living in a file nobody can locate later. - Paper documents:
invoices filed physically and separated from the entry they support. - Shared accounts:
actions attributable to a role rather than a person.
This is why reconstructing an audit trail after the fact is expensive. The information existed at the time; it simply was not captured in a form that connects to the transaction.
Regulatory Requirements
Several frameworks require audit trails, with different emphases:
- SOX:
audit trails support the assertion that internal control over financial reporting is effective, by evidencing that controls actually operated. - HIPAA:
requires logging of access to protected health information, including views as well as changes. - 21 CFR Part 11:
governs electronic records in FDA-regulated industries, with strict requirements on retention and integrity. - Tax authorities:
generally require that reported figures can be traced to source records for a defined retention period.
A note on terminology: the Consolidated Audit Trail (CAT) is something different. It is a SEC-mandated reporting system tracking orders and trades across US securities markets, and it is unrelated to the accounting audit trail described here despite the shared name.
Frequently Asked Questions About Audit Trail
1. What is an audit trail?
An audit trail is a chronological record showing the history of a transaction: what was created or changed, by whom, when, and often the values before and after. It allows any figure in the financial statements to be traced back to its source document.
2. What should an audit trail record?
The named user who acted, a timestamp with time zone, the action taken, the record affected, the values before and after any change, and a link to the supporting document. Shared logins undermine the record because actions become unattributable.
3. What is an example of an audit trail in accounting?
For a supplier invoice: receipt timestamp, matching against the purchase order and goods receipt, the flagged variance, who reviewed and resolved it, the approval and approver, the ERP posting and period, the payment with its trace number, and the bank reconciliation.
4. How does the audit trail work in QuickBooks?
QuickBooks Online has an Audit Log under settings showing date, user, event, and transaction, and it cannot be disabled. QuickBooks Desktop provides an Audit Trail report of added, modified, and deleted transactions with prior values retained.
5. Why do manual processes create audit trail gaps?
Approvals given over email, discrepancies resolved by phone, workings kept in unlocatable spreadsheets, and shared logins all leave decisions unconnected to the transaction they affected. The information existed but was never captured in a linkable form.
6. What regulations require an audit trail?
SOX relies on audit trails to evidence that financial reporting controls operated. HIPAA requires logging access to health information. 21 CFR Part 11 governs electronic records in FDA-regulated industries, and tax authorities require traceability to source records.
7. What is the Consolidated Audit Trail?
The Consolidated Audit Trail (CAT) is a SEC-mandated system tracking orders and trades across US securities markets. Despite the similar name, it is unrelated to the accounting audit trail that documents changes to financial transactions.
