Audit Trail
Definition
A log maintained by an accounting system, ERP, or cloud application recording who accessed, created, modified, or deleted each record, with timestamps. Audit trails are often the most probative evidence in financial fraud cases, showing which user made the fraudulent entry.
- Records
- User, action, and timestamp per event
- Typical source
- ERP, accounting software, cloud apps
- Evidentiary weight
- Often the most probative evidence in fraud cases
- Weak point
- Alterable by users with admin or DBA access
Common questions
Can an audit trail be edited or deleted by the person committing the fraud?+
Yes, if that person holds administrative or database access. Investigators handle this by cross-checking the live trail against independent copies such as backups, exports or third-party logs whenever insider access is a possibility.
Why is a database audit trail treated as stronger evidence than a general system log?+
It ties a specific user account to a specific record change at a specific time, which directly supports proving who made a fraudulent entry rather than just that some activity occurred.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Electronically Stored Information (ESI)
- Any information created, stored, or transmitted in electronic form, including emails, database records, spreadsheets, accounting system logs, chat messages, and metadata. ESI...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Legal Hold
- A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant...
- Metadata
- Data about data. In document forensics, metadata includes file-creation timestamps, last-modified dates, author fields, revision history, and embedded GPS coordinates in images....