BlogSoftware
Audit trails in business software
By Micah Ondiwa, Senior Software Engineer 1 min read
Recording who did what, when and why supports accountability, investigations and compliance — if it is designed in from the start.
When a figure changes unexpectedly, the first question is who changed it. Without an audit trail, nobody can answer.
What to record
- The user, time and action.
- The record affected and its values before and after.
- The reason, for sensitive changes.
- Where the action came from — screen, API, import.
Make it tamper-resistant
Store audit entries separately from the data they describe and do not allow users to edit them.
Cover reads where needed
For sensitive data such as health or financial records, record who viewed records, not just who changed them.
Make it usable
Provide screens to search the trail by record, user and period. An audit trail nobody can query is of little use.
Plan retention
Keep audit data as long as regulations and your policies require, and archive it efficiently.
See our business software development.
About the author
Micah Ondiwa
Senior Software Engineer
Micah Ondiwa writes about software engineering — application architecture, APIs and integration, data and AI-assisted development, and reliable delivery.