Audit Trail Explained: Definition, System Logs and an Audit Trail Test

"Audit trail" is used in at least three senses. In bookkeeping it means the chain from a source document to a ledger entry to the financial statements. In IT it means the system log of who did what and when. In an audit file it can mean the cross-referencing that lets a reviewer follow the auditor's own work. The sense matters, because each one supports a different test.

This guide defines each, shows what the QuickBooks Online audit log does and does not record, and walks through an audit trail test with a worked example.

What is an audit trail?

An audit trail is a record that lets someone trace a transaction or a change from the beginning to the end, and from the end back to the beginning. Two forms matter in a financial statement audit.

The third sense, the auditor's own trail, is the cross-referencing and indexing that AU-C 230 expects in the audit file. The guide to audit working papers covers it.

Why the audit trail matters to an auditor

The auditor needs to understand how information enters the ledger. AU-C 315, as revised by SAS 145, requires understanding the entity's information system and its use of IT, and the general IT controls over the applications relevant to financial reporting. The audit trail is part of that. A system with no usable log gives the auditor no way to tell a legitimate adjustment from one made after the books were reviewed.

It also matters for fraud. AU-C 240 requires the auditor to test journal entries and other adjustments for management override. That test depends on a complete population and on the ability to see who made the entries and when. See journal entry testing under AU-C 240.

What does the QuickBooks Online audit log record?

According to Intuit's support documentation, the QuickBooks Online audit log tracks more than financial transactions. It includes user sign-ins, changes to settings, and edits to customers, vendors, employees and payroll. Each entry shows the date of the change, the user who made it, and the original transaction details. The audit history of a single transaction shows who changed it, when, and what the changes were.

Points that affect how you rely on it:

• Access. Admin access is required to see the audit log. Viewing a transaction's audit history needs full access rights.
• Retention. Events are available for two years. A prior-year entry more than two years old will not be in the log, so the trail for earlier periods depends on exports made earlier.
• Time zone. Times are stored on Intuit's servers in GMT and displayed in the viewer's local time zone, which matters when judging whether an entry was made after a cutoff.
• Not recorded. Intuit's pages state the log does not show the source IP address or which reports a user viewed or downloaded.
• Non-transaction events. For events such as sign-ins or setting changes there is no field-level history of the data changed.

Check what the client's own subscription offers for export or printing, and obtain the log for the audit period before the retention window passes. A log obtained from the client should be treated as information produced by the entity; see information produced by the entity. The control that complements the log is the closing date: a company can set a closing date, optionally protected by a password, so that changes to entries dated on or before it are blocked or prompt a warning. A closing date with a password known to few people is a control the auditor can test.

How to perform an audit trail test

1. Understand the system and who has access. List the users with admin or full rights, who can edit or delete transactions, and who can change the closing date.
2. Obtain the log and test completeness. Compare counts or totals in the log to the ledger for a short period. A log that cannot be reconciled to the ledger is weak evidence.
3. Define risk criteria for entries. Examples: manual journal entries; entries created or edited after period end but dated within the period; entries by users who do not normally post; round-dollar entries; entries to unusual account pairs; entries posted on weekends or late at night local time; voided or deleted transactions.
4. Select entries. Select by criteria and add some unpredictable selections. See journal entry testing.
5. Trace each selected entry to support. Agree the amount, date, accounts and description to the source document and check the approval.
6. Test the log for tampering. Look for edits to prior-period entries after the closing date, changes to the closing date itself, deletions of transactions, and changes in user permissions near period end.
7. Follow up on exceptions. Ask the preparer, review the explanation against evidence, and evaluate whether the entry is a misstatement or an indicator of fraud risk.
8. Document. Record the population source, criteria, selections, results, exceptions and conclusion. See how to document audit procedures.

Worked example (illustrative)

A client's year ends December 31, 2026 and the books were closed in the system on January 15, 2027 with a closing date set to December 31, 2026. The auditor obtains the audit log on February 10, 2027 and filters for entries dated in 2026 but created or edited after January 15, 2027.

The filter returns three entries. Two are routine depreciation entries posted by the outside accountant. The third is a journal entry dated December 31, 2026, created by the controller on January 28, 2027 at 9:42 pm local time. It debits accounts receivable and credits revenue for $60,000, with the description "year-end adjustment".

• The entry was created after the closing date was set, so the closing date must have been lifted or bypassed. The log shows the closing date setting was changed on January 28, 2027 by the same user.
• The auditor requests the support. The controller supplies an email approving a customer bill, but no contract, shipment or delivery record.
• The auditor tests the revenue and receivable. Delivery evidence shows the work was performed in February 2027. The entry is a $60,000 cutoff misstatement with an indicator of management override.
• Overall materiality is $75,000, so the item is below it. The auditor still considers qualitative factors under SAB 99 thinking, including that a post-close entry that raises revenue might change a covenant calculation or bonus. The auditor discusses the entry with those charged with governance, asks management to record the reversal, and revisits the fraud risk assessment.

The test worked because the log showed who, when and what changed, and because the auditor filtered on the one pattern that matters: dated in the period, entered after close.

Limits of the audit trail

• A log shows what the system recorded. It does not show whether the entry was right.
• A user with admin rights may be able to change settings that affect what the log shows.
• Entries made outside the system, such as spreadsheet adjustments to the trial balance, leave no system trail. The standard includes "other adjustments" in the test for that reason.
• Retention periods in the software may be shorter than the audit period, so request logs early.

Frequently asked questions

What is an audit trail in accounting?

A record that lets you trace a transaction from source document to the financial statements and back, and in a system context a log of who created, changed or deleted entries and when.

Does QuickBooks Online have an audit trail?

Yes. The audit log records sign-ins, setting changes and edits to transactions and lists, with the user, date and original transaction details. Intuit states that events are available for two years and that admin access is required.

Is an audit trail required by GAAS?

GAAS does not use the phrase as a requirement. AU-C 315 requires understanding the information system, and AU-C 240 requires testing journal entries, which in practice depends on being able to trace entries and see who made them.

What is the difference between an audit trail and an audit log?

An audit log is the system record of events. An audit trail is the broader ability to follow a transaction from start to finish, of which the log is one part.

Sources

• Intuit, Use the audit log in QuickBooks Online (retention, access, fields recorded): https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/use-audit-log-quickbooks-online/L2WoVnW6I_US_en_US
• Intuit, View transaction changes in the audit history in QuickBooks: https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/view-transaction-changes-audit-history/L7obVhic2_US_en_US
• AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
• AICPA, AU-C Section 315, as revised by SAS No. 145
• AICPA, AU-C Section 230, Audit Documentation

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error