Audit Log (Audit Trail)
A chronological, tamper-resistant record of who did what, when, and from where in a system. Immutable audit logs cannot be edited or deleted, which is what makes them evidence rather than notes.
Why it matters
When money or data moves, disputes eventually follow: a missing voucher, a changed price, a deleted customer. Without an audit trail the answer is someone's memory against someone else's. With one, the system itself testifies. Audit logs also deter quietly: people behave differently when actions are attributable.
How it works
Every meaningful action (create, approve, edit, delete, login) is written as an event with actor, timestamp, and context. Immutability is enforced by design: application roles get insert-only access, deletions are soft and logged, and sensitive events may be hash-chained so any tampering breaks the chain visibly.
A real-world example
A boutique notices a bill for a large sale has vanished. In a system with an owner-only delete policy and a permanent log, the record shows which account deleted it and when, turning a mystery into a five-minute conversation. In a spreadsheet, that sale simply never existed.
Common mistakes
- ✗ Logging only logins while the actions that matter (approvals, edits, deletions) go unrecorded
- ✗ Letting administrators edit or purge the log, which converts evidence back into opinion
- ✗ Keeping logs nobody can read or search, retention without accessibility
- ✗ Treating logs as an afterthought instead of designing them into every workflow
Best practices
- ✓ Make the log insert-only at the database layer, not just in the UI
- ✓ Record the business meaning (approved voucher V-104 for X amount), not just raw table changes
- ✓ Surface the trail in-product so owners can self-serve answers
- ✓ Align retention with your compliance needs and review access to the log itself
Frequently asked questions
What should a small business log at minimum?
Every financial mutation (create, approve, edit, delete), every login, and every permission change, each with actor and timestamp. That covers most disputes and most compliance questions.
Are audit logs a legal requirement?
Depends on jurisdiction and industry, but financial record-keeping obligations generally assume trustworthy records. Immutable logs make audits faster and cheaper regardless of whether a statute names them.
Do audit logs slow systems down?
Writing an event row per action is negligible for typical business volumes. The real cost is designing them well; the real price is not having them.
Every AEGIBIT product writes an immutable trail: PayMint anchors every voucher to a person, place, and minute; Vestiq logs every bill and payment action permanently.
Audit-grade logging in PayMint →