Financial Planning & Collaboration

Audit trail

Also known asAudit log

Definition

An audit trail is a timestamped, attributable record of who accessed or changed a piece of information, what they did, and when. Because every entry names who acted, questions about a record can be answered from the trail instead of from memory. For an advisory firm, it is evidence that client data was handled as the firm's policies say.

By Olomon EditorialLast updated
Jump to section

Key takeaways

  • Two properties make a record an audit trail: every entry is timestamped, and every entry is attributed to the person or system that acted.
  • It covers access as well as change. Who viewed sensitive client data is as much a compliance question as who edited it.
  • SEC Rule 17a-4 names it for broker-dealers: a complete time-stamped audit trail of every modification and deletion is one of two permitted ways to keep electronic records.
  • The adviser books-and-records rule, Rule 204-2, never uses the phrase, but it requires procedures that safeguard electronic records from alteration and limit access to authorized personnel, which is what an audit trail lets a firm demonstrate.
  • A trail has to be written as events happen. One reassembled later from email and login histories can only show what those systems happened to record.

How Olomon thinks about this

An audit trail is only as complete as the record it sits on, which is why Olomon keeps one on the household's record itself: every permission change, data access, and modification is logged with a timestamp, the actor, and context. An advisor reading from a client-owned record therefore has its access history written as it happens, rather than reassembled from email and CRM logins when someone asks for it. The household decides who gets access in the first place, so the permissions and the trail describe the same arrangement.

In-depth definition

An audit trail answers a question that tends to arrive long after the fact: how did this record come to be the way it is, and who was involved? Answering it depends on every entry recording what was done, to which record, when, and by whom. Federal security standards define an audit trail in the same terms, as a chronological record that reconstructs the sequence of activities surrounding an event from inception to result,[1] and use the related term audit log for the running record of a system's activity over a period.[2]

For an advisory firm the useful trail records access as well as change. Who edited a client's file is half of what a compliance question asks; the other half is who looked at it, which matters most for sensitive data that several people inside and outside the firm can reach. Once a client document has been emailed, every later opening of it happens out of sight, so a trail that records reads has to be part of the system holding the record rather than something assembled afterward.

What the SEC's recordkeeping rules say

SEC recordkeeping rules spell the idea out for broker-dealers. Rule 17a-4 allows a broker-dealer to keep electronic records in a system that maintains a complete time-stamped audit trail of every modification and deletion, the date and time of each action, and, where applicable, the identity of the individual who took it, as the alternative to storage that cannot be rewritten or erased. The trail must hold enough to re-create the original record if it is changed or deleted, and the system must be able to download the record and its audit trail for regulators.[3]

The investment adviser rule is less prescriptive. Rule 204-2 requires an adviser that keeps records electronically to maintain procedures that reasonably safeguard them from loss, alteration, or destruction and that limit access to properly authorized personnel and the SEC's examiners.[4] It never uses the phrase audit trail, but a trail is a practical way for a firm to show that access really was limited, rather than only that it was supposed to be.

Frequently asked questions

  • The terms are often used interchangeably. Where they are distinguished, as in federal security standards, an audit log is the running record of a system's activity over a period, and an audit trail is the sequence of entries that reconstructs what happened around a particular record or event. For a compliance question the practical test is the same either way: every entry has to say who acted, what they did, and when.

  • Not by that name. Rule 204-2, the adviser books-and-records rule, requires an adviser that keeps records electronically to maintain procedures that safeguard them from loss, alteration, or destruction and limit access to authorized personnel and the SEC's examiners, and to produce a true and complete copy of a record promptly when examiners ask. An audit trail is a practical way to show those procedures were followed. Broker-dealers face a more explicit requirement under Rule 17a-4. How a particular firm meets either rule is a question for its compliance team or counsel.

  • Four facts for every event: what happened, such as a view, an edit, a deletion, a share, or a permission granted or revoked; which record, or which part of it; when; and who, whether a named person or a system. Useful trails add context, such as the role or permission the person acted under, and keep enough detail to show what a record looked like before it changed.

  • A trustworthy one cannot be changed quietly. If entries can be altered or removed without leaving a trace of their own, the trail stops being evidence of anything. Rule 17a-4's audit-trail option makes the same point in regulatory terms: it must capture every modification and deletion, and keep enough to re-create the original record.

Sources

Primary, authoritative references.

  1. 1

    National Institute of Standards and Technology (NIST)

    CSRC Glossary: audit trail

    Cited for: The federal security-standards definition of an audit trail as a chronological record that reconstructs the sequence of activities surrounding an event

  2. 2

    National Institute of Standards and Technology (NIST)

    CSRC Glossary: audit log

    Cited for: The companion definition of an audit log as a chronological record of system activities over a given period

  3. 3

    Electronic Code of Federal Regulations (National Archives)

    17 CFR 240.17a-4: Records to be preserved by certain exchange members, brokers and dealers

    Cited for: Paragraph (f)(2): the broker-dealer audit-trail alternative, recording modifications and deletions with dates, times, and the individual's identity, able to re-create the original record, and downloadable for regulators

  4. 4

    Electronic Code of Federal Regulations (National Archives)

    17 CFR 275.204-2: Books and records to be maintained by investment advisers

    Cited for: Paragraph (g): an adviser's procedures to safeguard electronic records from loss, alteration, or destruction, to limit access to authorized personnel and the Commission, and to provide copies promptly to examiners

Continue exploring

Cite this page

APA
Olomon Editorial Team. (2026). Audit trail. Olomon Financial Glossary. https://olomon.com/financial-glossary/audit-trail

Ready to organize your financial world?

Olomon helps you organize your financial life, build wealth, and plan your legacy, all in one secure platform.

Get StartedHow Olomon works