Audit trail, explained

An audit trail is the history behind every number in your books. For each entry it shows who posted it, when, why, and the document that supports it, such as an invoice, a contract or a receipt. It also records what happened later: who approved it, who reversed it, who locked the month.

Despite the name, auditors aren't the only readers. A new controller, a lender or a buyer uses the same trail to check where a figure came from.

Much of it is captured automatically, since accounting systems log the user and time on every post and edit. The part that takes discipline is evidence. The actual document gets attached to the entry, and approvals are recorded in the system instead of in Slack or email.

The other half is never destroying history. Posted entries are reversed, not edited or deleted, and each person has their own login so every action has a name on it.

During the year, a categorization rule codes Acme's AWS charges to hosting. Acme's founder approves an annual software prepayment in the accounting system and attaches the contract. In the Q3 CPA check, the CPA checks classifications and signs off in the same place. Each step is a line in the trail with a name and a date.

A year later an auditor picks that prepayment as a sample. Opening the entry shows the contract, the approver and every month of amortization since. The question is answered in minutes, with no inbox search.

Reversals and period locks keep the trail intact, and a CPA check relies on it each quarter. Formal internal-control rules under SOX apply to public companies, but auditors and acquirers of private companies test much the same things.