Audit trail

An unchangeable record of every check, decision, and reviewer action.

It works like a flight recorder for a verification system. If someone later asks what happened with a case, the record shows each step, in order, with the time it occurred.

Immutable, timestamped event logging of inputs, model versions, decisions, and human actions. Immutable means entries cannot be changed or deleted after they are written, and a timestamp records exactly when each event happened.

A useful audit trail records several kinds of events:

• Inputs, such as the document, selfie, and data that went into a check.
• Model and rule versions, so a team can tell which logic produced a decision.
• Decisions, with the outcome, the score, and the reasons.
• Human actions, such as who reviewed a case, what they saw, and what they chose.
• Changes to configuration, such as edits to thresholds or flows.

Systems make the record trustworthy in a few ways:

1. They write each event once, in order, and block edits to past entries.
2. They protect access, so only authorized people can read the log.
3. They keep the log for a defined retention period.
4. They make it searchable, so a team can reconstruct a case on request.

An audit trail sits next to terms that are easy to mix up:

• Case management is the workspace where analysts handle cases, and it generates much of the audit record.
• SOC 2 is an audit report in which logging and monitoring controls are often examined.
• Decisioning engine is the component whose decisions the trail records.