What It Actually Means
The distinction between a log and an audit trail is worth holding onto. A log is written for engineers, to diagnose faults, and it is usually rotated away after a few weeks. An audit trail is written to answer a question later, often to somebody outside the business, and it has to survive long enough to do that.
When You Suddenly Need One
Audit trails feel like overhead right up until a specific moment arrives, and by then they cannot be created retrospectively.
A client disputes what was agreed and when. A regulator asks for evidence that a document was reviewed by the right people in the right order. A figure is wrong and the question is whether it was entered wrong or changed later. Someone leaves and you need to know what they touched in their final fortnight. An insurer asks what happened during an incident.
Each of those is answerable in seconds with a proper trail and unanswerable without one. The cost of building it is small and paid up front. The cost of not having it is unpredictable and paid at the worst time.
What Separates A Real One
Four things, and the last two are the ones usually missing.
Who, precisely. A named user, not a shared account and not “system”. Shared logins destroy audit trails completely, which is the strongest practical argument against them.
What changed, including the previous value. “Record updated” is nearly useless. “Credit limit changed from 5,000 to 25,000” answers the question.
Immutability. If a trail can be edited by the people it records, it proves nothing. It has to be append-only, and administrators should not be an exception.
Retention that matches the question. Trails kept 30 days answer operational questions. Disputes and regulatory questions arrive months or years later, so retention should be set against how long you might be asked rather than against storage cost.
What To Ask
- Can you show me who changed this field and what it was before? Ask against a real record. The demo answer and the production answer are often different.
- Can an administrator edit or delete the trail? If yes, it is a convenience feature rather than evidence.
- How long is it kept, and is it included in backups?
- Is it readable by a non-technical person? A trail that needs a developer and a database client to interpret will not be consulted when it matters.
The Balance To Strike
Recording everything is its own failure. A trail capturing every page view buries the twelve entries that matter under two million that do not, and the storage cost invites someone to shorten retention, which removes the value entirely.
The useful discipline is to record decisions and changes to things that matter: money, permissions, status, personal data, anything contractual. Leave routine reads out unless the data is sensitive enough that reading it is itself a decision.
Under UK GDPR the trail is also personal data about your staff, so it needs a retention period and a reason like anything else. Where this is a core requirement rather than a background one, it is worth designing deliberately: see audit trail systems.
More terms are in the glossary.
