An audit trail, or sometimes referred to as an audit log, is a documented flow of transactions, security relevant records, or data changes that are date and time stamped. It keeps a sequential record of the history and details around the change. Depending on the area of expertise, audit trails/logs come in different shapes and sizes to record their unique areas of focus.
The main focal point of an audit trail is to maintain a register of every action, event, or activity a user or a system executed on an application, database, operating system, or network i.e. It can be the creation, modification, or the deletion of a record, or it can be a sequence of automated system actions.
For example, in an audit trail in a cloud environment, when an activity occurs on a user account, that activity is recorded as an event that provides details of what the user’s activity was in the cloud environment. Monitoring user activity in that manner is sometimes referred to as audit tracking, which means in this regard a user’s every step is tracked in the cloud environment.
Generally speaking, there aren’t really any “types” of audit trails, but audit trails are generally mentioned as a type when it comes to the context in which they are being used and what type of data/records are being recorded in the audit trail. A record can be stored in form of an action, event, or activity that is recorded in either an application, database, operating system, or network:
| Record Type | Description |
| Action | A user just approved a change on a change management system. The audit log will reflect the actions of the user in the audit log. |
| Event | An automated job kicked off the process of backing up data on a server at 22:00. This event will be recorded in the audit log |
| Activity | A user logged on at 08:05 on Windows. The activity of the user “logging on” will be reflected in the audit log. |
An audit trail report can be described from an accounting point of view and a technical point of view.
The audit trail report, in an accounting sense, is a comprehensive record of all transactions entered within a defined period. The audit trail report extracted from the accounting system can include details like date, type of entry, category of the transaction, and value. Each transaction will also indicate who recorded the transaction. This is particularly useful if you need to trace a transaction or if it is requested by the auditors as part of their sample selection.
The audit trail report, in a technical sense, is a comprehensive record of all activity in a particular system. This can also be an accounting system, for example, or a database. The audit trail report extracted from a database can include details like username, log-on date and time, changes made, and table name. This is particularly useful if you need to trace the activity of the user or trace a change that was made to the database. This type of audit trail report is also requested by the auditor when testing general IT controls or performing a SOC 2 audit.
