Every business should maintain a comprehensive audit trail of the precise sequence of actions and events for their work processes, that form a complete record of what has been done and who has done it. This will help when auditors (and potentially lawyers) seek to determine the company policies and practices that were in effect at a given time.

Keeping Comprehensive Audit Trails

Good audit trails will allow you to undertake retrospective studies of business performance; will prevent repeat work from being undertaken; provide protection of liability from the errors of others; protect your intellectual property; provide a learning history to facilitate the replication of activity. They will help if you are involved in reviews or investigations at the request of customers, suppliers or former employees.The audit trail should include:

• Correspondence sent and received
• Telephone calls made and received
• Email in and out
• Actions taken and decision made
• Meetings held

You should assess carefully what needs to be captured to provide your audit trail, whether in paper or electronic format. For example, for important outgoing telephone calls, the member of staff should record their name, the matter, the date and time, the name of the person called and a description of the discussion. If the call required prior authorisation, details of this should also be recorded. This will ensure that an accurate record is captured. This record should then be retained so that:

• It complies with any legal or regulatory requirements for retention
• Its content, meaningful context (circumstances of creation and relationships) and the structure (logical and physical attributes) are maintained
• It remains authentic and can be trusted
• It is securely maintained to prevent unauthorised access, alteration or removal
• That it can be accessed and interpreted through time
• That it cannot be repudiated

If audit trail records are held electronically, it is important to ensure that unalterable system audit trails are provided to record the User, Date, Time, Action and Results. Especially for electronic commerce applications, the complete "visual presentation" of the transaction/record must be retained.