What is an audit trail?
A regulator asks who approved a change last March. Your application log rotated out that week, so the honest answer is you don't know.
Audit trail
audit log
An audit trail is a chronological, tamper-evident record of who took an action, what it changed and when. It is kept separately from the system it watches. That way, nobody with access to that system can quietly edit the record of what they did.
Three facts make an entry an audit trail rather than a note: who acted, what changed, and when. Drop any one and the record cannot answer the question it exists for.
The record also has to survive the person it describes. If an admin can delete their own entry, the trail proves nothing under dispute. Write-once storage, a separate database role, or an append-only table all satisfy this. A shared login that never changes does not, because no entry can say which human held it.
It's not the same thing as your application log
Most systems already log something. A web server writes request lines, an app writes errors, a queue writes job status. None of that is an audit trail, and the difference is ownership.
An application log exists to help an engineer debug. It rotates on a schedule, an engineer can filter it out or delete it, and nobody signs off on what it kept. An audit trail exists to answer a dispute. It has an owner, a retention rule chosen on purpose, and no engineer with a reason to make an entry disappear.
AI features add a fourth thing to record. An agent that approves a claim or flags a transaction made a decision, and a decision is more than a changed row. The audit trail for that decision has to hold the input it saw, the model version that produced the output and the output itself, together. Without the model version, a later question about why an older decision came out differently has no answer.
- 01An application log answers 'what broke'. An audit trail answers 'who is responsible'.
- 02Retention on an app log is an engineering convenience. Retention on an audit trail is a policy someone can defend.
- 03An AI decision needs the model version stored next to the input and output. The outcome alone is not enough.
- ActorThe person or service account, named.
- ActionWhat changed, in specific terms.
- TimestampWhen, to the second.
- ContextThe record it touched, and its state before.
- StoreAppend-only, outside the actor's reach.
Miss context and the entry says a change happened without saying what it replaced.
Common questions
01Is an audit trail the same as an audit log?
Yes, the terms are used interchangeably. Both mean a tamper-evident, chronological record of who did what and when. Some teams reserve 'log' for the raw entries and 'trail' for the reviewable sequence, but no standard enforces that split.
02Does every system need one?
No. A tool with one user and no dispute risk gets nothing from it beyond debugging, which an application log already covers. It earns its cost in three cases. Multiple parties touch the same record. A regulator can ask for history. Or an AI system makes a decision a person will later contest.
03Can you add an audit trail to an existing system later?
Yes, but the record only covers what happens after it goes in. It cannot reconstruct history the system never captured. The honest answer to a request for last year's activity is that the trail starts on the date it was added, not before.
04What has to be logged for an AI agent specifically?
The input the model received, the model version that produced the output, and the output itself, stored together as one entry. A version number alone is not enough. Without the paired input, a later review cannot tell whether a bad decision came from the model or from what it was given.
Where the record has to survive a dispute
Related
- what Part 11 requires of a system →The regulated version of this record, spelled out for FDA-covered software.
- insurance software development →Where scattered records and disputed audits are the daily problem.
- LLM observability →The related practice for reconstructing an AI answer instead of an approval.
