Audit Trail

An audit trail is a complete, chronological log of all events in a system. Every action is recorded with a timestamp, the person or process responsible, and the content of the action. The log can be read afterward to reconstruct what happened. It is neither deleted nor altered after the fact – that is the decisive point. You can think of an audit trail like a logbook: every trip is recorded, the order cannot be changed, and no one is allowed to tear out pages.

Why immutability matters

Without an audit trail, it is often impossible to determine afterward what actually happened following an error or fraud. With a complete log, auditors – such as accountants or regulatory authorities – can trace every step. This protects companies from false accusations and exposes actual violations.

Immutability is especially important. A log that someone can edit afterward has no evidentiary value. That is why audit trails are technically secured so that entries can be added, but not deleted or overwritten. Some systems use cryptographic methods for this – mathematical techniques that would make any subsequent alteration measurable.

In the European Union, regulations such as the GDPR or the AI Act mandate logging requirements for certain systems. A missing or manipulated audit trail can directly lead to fines during an inspection.

What makes up an audit trail

A single entry typically contains four pieces of information: the timestamp, i.e. the exact moment of the action; the identity of the originator, i.e. the user or process; the type of action, for example “file opened” or “model parameters changed”; and the state before and after. Together, these entries form an unbroken chain.

For AI systems, special requirements apply. It is not enough to log only user inputs. It must also be recorded which version of the model made a decision, what data was available at the time, and what output was produced. Only this way can one later assess whether an AI system worked correctly – or whether an error lay in the model, the data, or the users.

A common misconception: many people confuse the audit trail with a simple log file. A log file also records events, but is usually intended for technical troubleshooting, can be deleted, and is not necessarily tamper-proof. The audit trail is its legally and organizationally secured counterpart.

Audit trails in products and the news

In the financial sector, the audit trail has been mandatory for decades. Anyone trading on a stock exchange automatically generates an entry for every order, which remains retrievable for the regulatory authority. This prevents insider trading, or at least makes it provable.

In the field of artificial intelligence, this topic is currently moving strongly into focus. If an algorithm rejects a credit application or suggests a medical diagnosis, companies in many countries must be able to explain how that decision came about. The audit trail provides the basis for this. Without it, an after-the-fact explanation is hardly credible.

In cloud software that companies use daily – from document management to personnel files – an audit trail is now usually built in by default. You can see at a glance who last opened, edited, or shared a file. What used to be considered an extra is becoming standard practice due to new laws and rising security requirements.