QULDEXResources · Glossary
What is an audit trail? Definition, contents and examples
What does an audit trail mean in practice?
Every system that matters to an audit should record its significant events without relying on anyone to remember: sign-ins, access changes, approvals, edits to records and changes to configuration.
An auditor uses the trail in two ways. It is evidence that a control operated, such as an approval given before a change went live. It is also the means of investigating when something goes wrong.
What should an audit trail record?
A named user or service account, never a shared login.
The event, the record affected, and the old and new values where relevant.
A reliable timestamp and the source, such as the system or network address.
What does an audit trail entry look like?
A control's status is changed from 'In progress' to 'Implemented'.
| Item | What it looks like |
|---|---|
| Who | Priya Nair, control owner |
| What | Control A.8.13 status changed from In progress to Implemented |
| When | 14 Oct 2026, 10:42, server time |
| Why | Reason entered: backup restore test passed; evidence linked |
| Approved by | Reviewer acceptance recorded two hours later |
This is an illustration written for this page, not a customer record.
Which frameworks require an audit trail?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Annex A 8.15 | Logs that record activities, exceptions and other relevant events are produced, stored, protected and analysed. |
| SOC 2 | CC7.2 | System components are monitored for anomalies that could indicate malicious acts, natural disasters or errors. |
| NIST CSF 2.0 | PR.PS-04 | Log records are generated and made available for continuous monitoring. |
| GDPR | Article 5(2) | The controller must be able to demonstrate compliance, which in practice needs records of what was done. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What goes wrong with audit trails?
Shared accounts
Actions are recorded against 'admin', so nobody can say who acted.
Instead: give every person and service their own identity.
Logs that can be edited
Administrators can change or delete the records that describe their own actions.
Instead: protect logs from change and restrict who can read them.
Kept, never reviewed
Logs exist but nobody looks until an incident.
Instead: define which events are reviewed, by whom and how often.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Audit Trail: common questions
What is the difference between an audit log and an audit trail?
The terms are often used for the same thing. Where a distinction is made, a log is the raw record of events in one system, and the trail is the connected sequence that lets you follow one action from start to finish.
How long should an audit trail be kept?
For as long as your legal, contractual and audit needs require. Set a retention period in policy, apply it consistently, and make sure it covers the whole period an auditor will examine.
Who should be able to see the audit trail?
Only people who need it, such as security, audit and compliance staff. Access to the logs should itself be recorded.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- NIST SP 800-92, Guide to Computer Security Log Management
- NIST Cybersecurity Framework (CSF) 2.0
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
An audit record that writes itself
Controls, evidence, findings and corrective actions in one audit workspace.