A good audit trail answers four questions about any financial record: who touched it, what changed, when, and who approved it. To get there, log the events that matter, give every user a unique login, store the evidence where administrators cannot quietly alter it, set retention by record type, and assign a named person to review it. The rest of this guide shows how, with a focus on the finance side of the business rather than server security.
TL;DR
- Log by risk, not by volume: financial-record changes, approvals, permission changes, logins, failed attempts and edits to settings come first.
- Every employee and service account needs its own identity. Shared logins make an audit trail useless.
- Keep copies in protected, separate storage, and make sure the people who review evidence cannot erase it.
- There is no single US retention period. Map retention to each record class, such as tax, payroll, contracts and legal holds.
- A log nobody reviews is weak evidence. Name an owner, set a review rhythm and test retrieval.
Table of Contents
- What an audit trail is, and what it is not
- What an audit trail should contain
- Best practices, in the order we would tackle them
- Audit trail controls: a risk-and-control matrix
- How the finance trail connects to your books
- How long to keep audit records
- What about the "3-1" rule?
- Putting it into practice in 30 days
- Our perspective
- When to bring in help
- FAQ
- Sources
What an audit trail is, and what it is not
An audit trail is a chronological record that lets you reconstruct what happened to a transaction or a system. NIST's guidance on audit trails describes them as supporting both operations and accountability: they help detect violations, investigate incidents, diagnose failures and establish what happened.
That last point matters for a finance team. An audit trail is evidence, not just a troubleshooting aid. When a bank, a buyer, a lender, an insurer or an auditor asks why a number changed, the trail is what lets you answer with facts instead of memory.
It is also not a substitute for other controls. Audit trails strengthen segregation of duties, approvals, reconciliations and management oversight. They do not replace them. The SEC's own language on internal controls speaks of reasonable assurance rather than absolute assurance, and that is the right expectation for any company.
Most search results for this topic come from the IT security world, where "audit log" means server and identity events. Those practices carry over, but a business owner or controller also needs the accounting layer: the journal entry, the invoice, the vendor bank change, the payroll run. We cover both below.
What an audit trail should contain
At minimum, each record should show what event occurred, when, where, its source, its outcome, and the identity of the person, process or object involved. That is the structure of FedRAMP's AU-03 control on audit record content, and it works as a template for any system.
For financial records, add a few fields that auditors and fraud investigators look for:
- The affected record: invoice number, bill, journal entry ID, vendor or employee record.
- Before-and-after values, where appropriate: the old and new bank account on a vendor, the old and new amount on a bill.
- Approval context: who approved, when, and under what limit.
- A correlation ID or reference, so a request, its approval and its payment can be tied together.
A simple test: pick a random payment from last quarter. Can you show who created the bill, who approved it, who released the payment, and whether anything was edited in between? If not, the trail has a gap.
A worked example
Suppose a vendor's bank details change on a Friday afternoon and a payment goes out Monday. A usable trail shows the user who edited the vendor record, the old and new account number (masked as needed), the timestamp, the approval or call-back confirmation, and the later payment tied to the same vendor. Without those fields you only know that money left. For small teams worried about exactly this scenario, our guide to stopping accounts payable fraud with small-team controls walks through the checks that sit around the log.
Best practices, in the order we would tackle them
1. Inventory your systems and high-risk events
List every system that touches money: accounting software, payroll, banking portals, expense tools, billing, the CRM if it creates invoices, and the file storage holding contracts. Then list the events that carry risk. AWS's guidance on comprehensive audit trails recommends centralized evidence collection and controls that prevent deletion or tampering, and starting from an inventory is how you get there.
For a finance team, the core events are:
- Sign-ins, failed sign-ins and multi-factor authentication changes
- Changes to user roles and permissions
- Creation, edit, void and deletion of transactions
- Changes to vendor, customer and employee master data, especially bank details
- Payroll submissions and rate changes
- Edits to accounting settings, chart of accounts and closed periods
- Exports of sensitive reports
2. Give every person and service a unique identity
No shared logins, ever. Indiana University's audit and accountability standard requires logging of both successful and unsuccessful logins and traceability to individual users, and that is a sound baseline for a company of any size. If the bookkeeper, the owner and the outside accountant all use one password, the trail can say that something happened but not who did it.
For each user, capture successful and failed logins, password or MFA changes, the source address, the device or session, and privilege changes. Alert on repeated failures, unusual locations, disabled logging and unexpected privileged access.
3. Synchronize clocks and standardize fields
Timestamps from different systems only line up if the clocks agree and the formats match. NIST SP 800-171 includes requirements for unique traceability, alerts on audit-process failure and synchronized time. In practice, pick one time standard, such as UTC, and one format for users and record IDs across tools.
4. Centralize and protect the evidence
Treat the trail as evidence. Google Cloud's audit logging guidance stresses restricted access and keeping logs in a separate destination, because an administrator who can change the source system may otherwise be able to erase the evidence.
The governance principle is simple: the people who review evidence should not automatically have unrestricted power to alter or delete it. In a small business that can mean:
- The owner or an outside accountant has read-only access to the audit log and to exported copies.
- The person who enters transactions cannot change user permissions.
- Monthly exports of the audit log go to a folder that the bookkeeper can add to but not delete from.
5. Do not log everything
The best audit trail is not the largest one. Sonar's audit logging guidance recommends relevance and data minimization: never record passwords, tokens, keys or unnecessary raw personal data in plain text. A trail full of Social Security numbers becomes a liability of its own. Define events from risk and business need, and write down what you intentionally exclude.
6. Alert, review and test
A log that exists but is never reviewed is weak control evidence. Assign an owner. Decide which events trigger an alert right away (a new bank account on a vendor, a closed-period edit, logging turned off) and which get a scheduled review. Then test: can you retrieve last March's entries in under an hour, do the alerts fire, are clocks still in sync? HashiCorp's guidance on audit trails makes the same point, that detailed logs enable rapid investigation only when they can actually be used during an incident or an audit.
Audit trail controls: a risk-and-control matrix
Controls are what turn raw logs into assurance. The simplest working tool is a matrix with one row per event you care about. Here is a starter version for a growing company:
| System | Event | Owner | Required fields | Review | Alert |
|---|---|---|---|---|---|
| Accounting software | Edit or delete of a posted transaction | Controller | User, record ID, old and new value, timestamp | Weekly | Edits to closed periods |
| Accounting software | Vendor bank detail change | Controller | User, vendor, old and new account (masked), approval | Each change | Every change |
| Payroll | Pay rate or bank account change | HR lead | User, employee, old and new value, approval | Each payroll run | Every change |
| Banking portal | New payee or payment release | Owner | User, payee, amount, approver | Daily | New payee |
| Identity provider | Role change, MFA reset, failed logins | IT lead or provider | User, source address, device | Monthly | Repeated failures |
| Logging itself | Logging disabled or export failed | Owner | Who, when | Continuous | Always |
Add columns for sensitivity, destination, retention and evidence of review as you mature. The matrix approach combines the granular access and alerting guidance from Google, the standardization advice from Sonar and the requirement in Indiana University's standard to document logs and review them annually or after major updates. Revisit the list whenever you change software, add a bank, or change who approves what.
If you want a second pair of eyes on which events belong on your list, our internal financial audit guide shows how a review of controls is usually run, and our piece on financial governance best practices covers who should own each control.
How the finance trail connects to your books
For finance teams, an audit trail should connect each material transaction to authorization, recording, asset accountability and reconciliation. The SEC's recordkeeping and internal controls provisions require issuers to keep books and records that accurately and fairly reflect transactions, and to maintain controls that provide reasonable assurance that transactions are authorized, recorded and compared with existing assets at reasonable intervals.
Those rules apply to issuers subject to the Securities Exchange Act, not automatically to every US business. A private company should scale its controls to its size, risk, systems, contracts and applicable tax or industry rules. Still, the four-part chain is a useful model for anyone:
- Authorized: someone with the right limit approved it.
- Recorded: it appears in the books, with a reference to the source document.
- Accounted for: the asset or liability exists and matches reality.
- Reconciled: bank, card, payroll and sub-ledger balances are compared to the ledger on a schedule.
Reconciliation is where many trails prove their worth, because it finds what the log did not flag. If you are building that habit, see our explainer on accounts reconciliation for finance teams.
Using your accounting software's own log
Most small businesses already have a basic trail. Intuit states that the QuickBooks Online audit log records not only financial transactions but account activity such as user sign-ins, settings changes and edits to customers, vendors and employees. Intuit also notes that events stay available for two years, and that sign-outs are only recorded when a user selects Sign out.
Two years is shorter than many tax and contract needs. If your records matter beyond that window, export the log or the underlying reports on a schedule and store them in protected storage, as described above.
How long to keep audit records
There is no single universal US retention period for audit logs. Set retention by applicable regulation, contract, litigation holds, tax needs and investigation requirements. Some real anchors:
- The SEC's rule on retention of records relevant to audits and reviews requires covered accountants to keep specified issuer audit and review records for seven years after the engagement ends. It is scoped to those accountants and engagements, not a blanket rule for every company's logs.
- The IRS says the right retention period depends on the record: it generally suggests keeping records for three years, and employment tax records for at least four years. Check the IRS page for exceptions that may apply to you.
- NIST requires audit records to be retained to the extent needed for monitoring, analysis, investigation and reporting, which leaves the exact number to you.
So treat retention as a business decision. Map it to each record class, such as tax support, payroll, bank and card activity, contracts, user-access logs and security events. Apply a legal hold when litigation or an investigation requires preservation, and say in writing who can lift it. Our checklist to organize business financial records is a practical companion for the document side of retention.
What about the "3-1" rule?
People searching for audit trail rules often land on "3-1". It is usually shorthand for a backup idea: three copies of important data, on one different medium, with an additional off-site copy. It is not a core audit-trail rule in NIST or FedRAMP. For audit evidence, prioritize independent, tamper-resistant storage, separation of access and tested restoration. A backup scheme that fails when you try to restore last year's log does not help you in an audit.
Putting it into practice in 30 days
You do not need a security team to make progress. A realistic sequence for a company of 10 to 100 people:
- Week 1: list systems and owners; remove shared logins; turn on MFA.
- Week 2: build the matrix above; confirm each system's native log is on and who can read it; note retention limits such as the two-year window in your accounting software.
- Week 3: set alerts for the highest-risk events (vendor bank changes, closed-period edits, new payees); set up a monthly export to protected storage.
- Week 4: run a retrieval test with a real question, such as "show every edit to vendor X in the last 12 months"; document gaps and exceptions; calendar a review after the next system change.
If you are also planning your own reporting calendar or website change log, a tool such as a free structured data audit for your site can help you keep a record of what changed on the public side, though it does not replace the financial controls above. Our own reading on reporting rhythm is in business financial reporting best practices.
Our perspective
We see the same pattern in many engagements: the software is logging everything, and nobody has ever looked. The first time anyone opens the audit log is during a cleanup, a payroll dispute or a suspected fraud, and by then the useful detail has aged out or the wrong people had permissions.
Our view is that the audit trail is a finance process before it is an IT feature. The controller or fractional CFO should decide which events matter, who reviews them and what "reviewed" looks like on paper. That is also why we pair bookkeeping with CFO-level oversight: the person who reads the monthly numbers should be the person asking why a vendor's bank account changed. Small teams can do this well with a short matrix, a monthly export and a quarterly review. They do not need a full-time executive to do it, and they do not need to log everything.
We also work with both for-profit and non-profit organizations, and the expectations differ. Grant-funded and donor-funded groups often need to show who approved which expense, while a closely held company may care most about owner-draw and payroll edits. Start from your own risks, not a generic checklist.
— Angelica
When to bring in help
If your books have gaps, if permissions have grown organically, or if you suspect something has already gone wrong, a clean-up and a control review usually come before any new tooling. We handle accounting and bookkeeping with fractional CFO oversight, QuickBooks setup and cleanup, payroll support and, when something looks wrong, forensic accounting. To talk through a control review or a fractional CFO engagement for your company, start at our fractional CFO services page.
FAQ
What are the best practices of an audit trail?
Log the events tied to risk, use unique accounts, synchronize clocks, store evidence centrally with restricted access, and make it hard to alter or delete. Then define retention, alert on suspicious activity and test that you can retrieve records. Review matters as much as collection.
What should an audit trail contain?
At minimum: what happened, when, where, the source, the outcome and who or what was involved. For financial records, add the affected transaction, before-and-after values, approval context and a reference that links related events.
How long should audit trail records be kept?
There is no single US period. Retention depends on tax rules, contracts, industry regulation and any legal hold. The IRS, for example, generally suggests three years for many records and at least four for employment tax records, but your own situation may require longer. Ask your accountant or attorney before you set a policy.
Is an audit trail the same as an audit?
No. An audit trail is the record of activity. An audit is a review that may use the trail as evidence. A strong trail makes any audit or internal review faster and less disruptive.
Sources
- NIST SP 800-12, Chapter 18: Audit Trails
- SEC Commission Guidance on Management's Report on Internal Control
- FedRAMP Audit and Accountability controls
- AWS: Establish comprehensive audit trails
- Indiana University IT-12 Audit and Accountability standard
- NIST SP 800-171 Rev. 1 excerpt
- Google Cloud: Best practices for Cloud Audit Logs
- Sonar: Audit logging best practices
- HashiCorp: Audit trails
- SEC: Recordkeeping and Internal Controls Provisions
- SEC: Retention of records relevant to audits and reviews
- Intuit: Use the audit log in QuickBooks Online
- IRS: Recordkeeping for small businesses