Documents & process
Audit Trail
The record of who did what, when, and under what authority — requester, approval chain, timestamps, and the evidence behind the decision. The test is whether someone who was not there can reproduce the decision years later.
That test is stricter than it sounds, and it is the one an auditor actually applies. A screenshot of an email thread does not pass it. Neither does a signature with no record of what was in front of the signer at the time.
The best audit trails are a by-product of working rather than an artefact assembled for the auditor — because an artefact assembled for the auditor has the same problem as a reconstructed site diary, and an auditor is trained to notice it.
Go deeper