The name of a reported subject never appears
The trail is readable far more widely than the reports. Writing a reported person's name into it would reveal sideways what the law forbids disclosing.
0708Compliance and audit
An audit trail is built as you go.
On the day of an inspection what counts is not what you did but what you can show. The trail fills itself, provided the work goes through the tool.
01The trail
Fourteen actions, all timestamped.
Every entry carries the author, their email address, the action, the entity concerned, the outcome and the timestamp. Value changes are kept separately, so you read the before and the after rather than a bare updated.
Logged actions
- Create
- View
- Update
- Delete
- Login
- Logout
- Export
- Approve
- Reject
- Invite
- Revoke
- Transfer
- Settings
- Permissions
| Timestamp | Author | Action | Entity |
|---|---|---|---|
| 12.04 09:14 | [email protected] | APPROVE | OnboardingFile approved after four-eyes validation |
| 12.04 11:02 | visitor (hosted link) | VIEW | OnboardingOpened by a third party without an account, traced by name |
| 12.04 16:37 | [email protected] | EXPORT | AuditLogFailure kept with its error message, not erased |
Viewing is logged for a precise reason: a visitor without an account who opens a file through a hosted link must leave a named trace, otherwise reading would be the only invisible act in the system.
02What the trail leaves out
An audit trail is not a record of everything.
Two rules deliberately take information out of the trail, because a trail that talks too much breaches obligations other than the ones it serves.
A failure is recorded like a success
The outcome of every action is kept, success or failure, with the error message. A trail keeping only what worked would give a false picture of what happened.
03Reports
What leaves the platform.
An inspection is prepared with documents, not with guest access to your dashboard. Exports are themselves logged, so it is known who took out what.
01The file report carries the identification, the questionnaire, the screening results and the decision.
02The audit trail exports, filtered by period, user, entity type or action.
03Training tracking produces the state per colleague, with the certificates issued.
04Every export leaves its own entry in the trail, with its author and date.
04Retention
Every record has its own calendar.
The periods do not follow from a single rule, and above all they do not all start from the same event. That is why they are carried by the data itself rather than by one global policy.
Suspicious transaction report
Ten years from the filing
Its own calendar: it outlives the file it came from and may come from no file at all.
Screening result
Frozen, with its coverage
The reach of the lists is stored in plain text with the result, so today's trace is not reread with tomorrow's coverage.
Questionnaire answer
With its question snapshot
A later redesign of the questionnaire does not change the grid an older file was graded on.