QULDEXResources · Glossary
What is an approval log? Contents and examples
What is an approval log for?
Many controls come down to approval: a change is approved before release, access is approved before it is granted, an audit stage is approved before the next begins.
The log lets an auditor check three things: that an approval exists, that it came from someone with the authority, and that it came before the action it authorised.
What must each entry record?
Exactly what was approved, so a later change does not inherit the approval.
A named person with the authority to decide.
The time of the decision and any condition or reason.
What does an approval log entry look like?
Approval to move an audit from fieldwork to reporting.
| Item | What it looks like |
|---|---|
| Item | Internal audit IA-2026-07, fieldwork stage, all tests recorded |
| Submitted by | Lead auditor, 14 Oct 2026 16:10 |
| Decision | Approved |
| Approver | Head of internal audit, 15 Oct 2026 09:32 |
| Comment | Two findings to be graded before the draft report is issued |
This is an illustration written for this page, not a customer record.
Which frameworks rely on recorded approvals?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 7.5.2 | Documented information is reviewed and approved for suitability and adequacy. |
| ISO 27001 | Annex A 8.32 | Changes to information processing facilities and systems are subject to change management. |
| SOC 2 | CC8.1 | Changes are authorised, designed, tested, approved and implemented in a controlled way. |
| ISO 27001 | Clause 6.1.3 | Risk owners approve the risk treatment plan and accept the residual risks. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What makes approvals hard to prove?
Approval by email or chat
The decision exists somewhere in an inbox.
Instead: record approvals where the work is tracked.
Approved after the fact
The timestamp is later than the action.
Instead: make the approval a condition of the next step.
Wrong approver
Someone without authority approved.
Instead: define who may approve each type of item.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Approval Log: common questions
Is an approval log the same as an audit trail?
It is part of one. The audit trail records all significant events; the approval log is the subset that records authorisation decisions.
Can someone approve their own request?
Not if the control relies on independent authorisation. The approver should be a different person from the requester.
How long should approval records be kept?
For as long as the thing they authorised matters to an audit, and in line with your retention policy.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
- ISO 19011:2018, Guidelines for auditing management systems
Every approval recorded where the work happens
Controls, evidence, findings and corrective actions in one audit workspace.