Audit trail
Also called audit log, activity log
An audit trail is a time-stamped record showing who did what, when and in which system. It captures actions such as creating, changing, approving or deleting a record or transaction. Firms use audit trails to prove that controls worked, to investigate incidents and to let supervisors reconstruct events after the fact.
How it works
Systems write a log entry each time a user or process acts on data. A good entry records the user or system identity, the date and time, the action taken, the record affected and, for changes, the value before and after. Entries are protected from editing or deletion, often by write-once storage or cryptographic hashing, so the trail itself can be trusted as evidence.
Compliance teams rely on audit trails across the business: case management decisions on alerts, changes to screening rules and thresholds, payment approvals, trading activity and access to customer data. Internal audit and regulators sample the trail to test whether controls ran as designed. Firms set retention periods to match their record-keeping rules and review logs for unusual access or changes.
The rules
Lets broker-dealers keep electronic records in a system with a complete audit trail as an alternative to write-once storage; the trail must record each modification or deletion, its date and time and the person responsible.
Broker-dealersRequires systems that can reconstruct material financial transactions, kept for five years, and audit trails to detect and respond to cybersecurity events, kept for three years.
Entities licensed by the New York Department of Financial ServicesRequires firms to keep records of all services, activities and transactions sufficient for the competent authority to supervise them and check compliance with the directive.
Investment firmsCommon questions
What should an audit trail record?
At a minimum, the identity of the user or system, the date and time, the action taken and the record affected. For changes, it should also show the value before and after, so a reviewer can rebuild exactly what happened.
How long must audit trails be kept?
It depends on the rule. NYDFS Part 500 sets five years for transaction records and three years for cybersecurity logs. Firms map each log type to the longest retention period that applies to it.
Why do regulators care about audit trails?
An audit trail is the evidence that a control ran and that a decision was made by an authorised person. Without one, a firm cannot show supervisors or auditors how an alert was closed, a payment approved or a record changed.
