# Audit trail, explained

> A permanent record of every entry: who made it, when, why, and the document behind it.

Source: https://lopifi.com/accounting/audit-trail
Part of: Lopifi — US GAAP books on autopilot, checked by a CPA (https://lopifi.com)

---

- **Section:** Controls & close
- **Reference:** Control
- **Mentioned in:** 4 pages

## What it means

An audit trail is the history behind every number in your books. For each entry it shows who posted it, when, why, and the document that supports it, such as an invoice, a contract or a receipt. It also records what happened later: who approved it, who reversed it, who locked the month.

Despite the name, auditors aren't the only readers. A new controller, a lender or a buyer uses the same trail to check where a figure came from.

Much of it is captured automatically, since accounting systems log the user and time on every post and edit. The part that takes discipline is evidence. The actual document gets attached to the entry, and approvals are recorded in the system instead of in Slack or email.

The other half is never destroying history. Posted entries are reversed, not edited or deleted, and each person has their own login so every action has a name on it.

During the year, a categorization rule codes Acme's AWS charges to hosting. Acme's founder approves an annual software prepayment in the accounting system and attaches the contract. In the Q3 CPA check, the CPA checks classifications and signs off in the same place. Each step is a line in the trail with a name and a date.

A year later an auditor picks that prepayment as a sample. Opening the entry shows the contract, the approver and every month of amortization since. The question is answered in minutes, with no inbox search.

Reversals and period locks keep the trail intact, and a CPA check relies on it each quarter. Formal internal-control rules under SOX apply to public companies, but auditors and acquirers of private companies test much the same things.

**Why it matters.** It's how an auditor or acquirer trusts numbers they didn't watch being made. With a complete trail, diligence is mostly an export.

## The entry, worked

Acme pays $24,000 up front for a year of a software platform. The founder approves the payment in the accounting system and attaches the order form.

**An entry with its evidence attached** — Balanced

| Account | Debit | Credit |
|---|---:|---:|
| Prepaid software | $24,000.00 |  |
| Cash |  | $24,000.00 |
| Total | $24,000.00 | $24,000.00 |

The entry carries the signed order form, the founder's approval and a link to its amortization schedule, so a reviewer can trace it without asking anyone.

## Common questions

### Is an audit trail a legal requirement for a private company?

Not in any particular form. GAAP says nothing about it, and the SOX internal-control rules apply to public companies. You do have to keep records that support your tax return, and any auditor will expect a trail they can test.

### What does an auditor actually look at?

Samples of entries, traced back to source documents and approvals. If every entry already carries its document and approver, sampling goes quickly.

### How long do I have to keep the records?

For tax, the IRS generally wants records kept three years after the return is filed, six if income was understated by more than 25%, and four for employment tax records. Records behind a loss carried forward or an asset still in use are kept until that year can no longer be examined. Many companies keep seven years.

## Where it comes up

The glossary entries, founder guides and lessons on this site that use the term and link here.

- [Audit trail](https://lopifi.com/md/glossary/audit-trail) (Glossary): The immutable record of every state change
- [Can you vibe code your startup’s accounting?](https://lopifi.com/md/startups/vibe-coding-your-accounting) (Guide · 3 min): AI coding tools build a finance dashboard in an afternoon, but not a closed, reconciled, GAAP-basis ledger. Where the line is, and how to stay inside it.
- [What to put on an invoice: a field-by-field guide](https://lopifi.com/md/startups/what-to-put-on-an-invoice) (Guide · 7 min): The fields a B2B invoice needs to get paid on time: legal names, a numbering sequence, dates, terms, tax lines, PO and remit-to, and how to fix one.
- [Closing the month](https://lopifi.com/md/learn/closing-the-month) (Lesson 13): Statements are not the end. The close proves every balance against something outside the ledger, then locks the period so the numbers can't quietly change.

## Read further

- [Controls & audit](https://lopifi.com/md/docs/domain/08-controls-and-audit) (In depth): Accounting software is not a database with forms on top. It is a system of controls, and the UI is where most of those controls are actually enforced.
- [Reversals](https://lopifi.com/md/accounting/reversal) (Related · Control)
- [Period locks](https://lopifi.com/md/accounting/period-locks) (Related · Control)
- [CPA check](https://lopifi.com/md/accounting/cpa-review) (Related · Control · Quarterly)

- **Previous:** [Reversals](https://lopifi.com/md/accounting/reversal)
- **Next:** [Lead schedule](https://lopifi.com/md/accounting/lead-schedule)

*General information for US companies, not tax, legal or accounting advice. Check the specifics with a CPA before you act on them.*