Audit Log

An audit log is the flight recorder of a system: an immutable, timestamped record of who did what, when, and from where. Once relevant only to auditors, it has become the backbone of accountability itself — the artefact every investigation, dispute, regulator and court eventually asks to see.

What It Is

An audit log (or audit trail) records security-relevant events in a system: logins and failed attempts, data views and changes, approvals, configuration modifications, exports — each with actor identity, timestamp, source, and before/after values where applicable. Quality attributes separate serious logs from casual ones: completeness (all sensitive actions covered), immutability (append-only or tamper-evident storage — hash-chaining is the strong form), attribution (individual identities, not shared accounts), and retention (long enough for regulatory and investigative needs). Logs are only as trustworthy as their protection: an editable log evidences nothing.

Why It Matters to You

Audit logs answer the questions that arise at the worst moments: who approved this transaction, who accessed this patient's record, what did the AI system decide and on whose authority. Regulators expect them for regulated data (healthcare access logging is explicit in many regimes), disputes turn on them, and AI governance increasingly requires them — an AI-influenced decision that cannot be reconstructed after the fact is ungovernable. The executive tests: does the system log the events that matter (not just logins — reads and exports of sensitive data), are shared accounts banned, is the log itself protected from the administrators it monitors, and can the organisation actually query it when needed?

When You'll Meet It

In security reviews, compliance audits, incident response, and any system handling sensitive or regulated data. Ask vendors not 'do you have audit logs' but 'show me the log format and who can modify it' — the answers separate theatre from capability.