Audit trail
The record of who did what, when and on what basis, kept so the work can be reconstructed and checked later.
In compliance, an audit trail answers an examiner’s questions without anyone having to remember: when the firm learned of a change, what it decided, who signed it off and which version of which policy it relied on.
An audit trail assembled after the fact is a reconstruction; one kept as the work happens is evidence.
Where the rules use it.
- ISO/IEC 27001 — Information security managementThe certifiable ISMS standard; Annex A controls per ISO/IEC 27002:2022.Global · 9 controls
- SOC 2 — Trust Services CriteriaSecurity, availability, processing integrity, confidentiality and privacy criteria for service organizations.Global · 8 controls
- FCA Handbook — SYSC (Senior Management Arrangements, Systems and Controls)Governance, compliance, risk control, internal audit, record keeping and financial crime systems and controls.United Kingdom · 6 controls