Who Changed What: The Audit Trail That Saves You Later

Nobody has ever asked us for an audit trail during a good week. The request always arrives attached to something else: a customer disputing a price, an insurer asking when a record was created, an auditor asking who approved a credit note, or the quiet, awful discovery that a number has been wrong for months and nobody knows since when.

An audit trail is worth nothing on every ordinary day and worth the entire system on one specific day, which is exactly why it never makes the requirements list.

What a real audit trail is

It is more than a "last modified" date, which tells you nothing useful. A proper change history records, for every meaningful change: who made it, when, what the value was before, what it became, and ideally why. It cannot be edited by the people it records. And it is queryable, because a log nobody can search is a log nobody will use.

This is precisely what a spreadsheet cannot give you. Version history in a shared file is better than nothing, but it tracks the document rather than the fact. It will not tell you that this customer's credit limit was raised, by whom, on what basis, and reversed a week later. It will just show you that the file changed on Tuesday.

What it is actually for

• Settling disputes. "That is not the price we agreed." A dated record of the quote, the change and the approval turns a two-week argument into a two-minute answer.
• Finding the cause of a mess. When a report goes wrong, the useful question is what changed and when. Without a history you are reduced to guessing and blaming.
• Meeting obligations. POPIA expects you to know who accessed and altered personal information. Auditors expect approvals to be evidenced. Insurers ask when a record was created, and "we think around March" is not an answer.
• Deterring the rare bad actor. Most fraud in small businesses is opportunistic and depends on nobody being able to reconstruct what happened. Visible history removes the opportunity quietly.
• Protecting your staff. This is the one people miss. When something goes wrong, the person who did nothing wrong is the one who benefits most from a record that proves it.

A change history is not surveillance. It is the difference between "somebody must have changed it" and "here is exactly what happened", and the second sentence protects innocent people far more often than it catches guilty ones.

Where to have it, and where not to bother

Logging everything is a real cost, in storage, in performance and in noise, and noisy logs get ignored. Be deliberate. The changes worth recording are the ones with money, risk or personal information attached: prices, discounts and credit limits; approvals and sign-offs; stock adjustments and write-offs; banking details, which is where invoice fraud always lands; changes to permissions; and access to personal data. Nobody needs a permanent record of who edited an internal note about the coffee order.

Say it out loud

Introduce change history openly rather than discovering it during an incident. Tell people it exists, what it records, and what it will and will not be used for. Systems where the logging is a surprise breed suspicion; systems where it is normal and explained are simply how a grown-up business operates. The same applies to your own conduct: if the trail records the owner's changes as faithfully as everyone else's, it will be trusted.

The cheapest insurance you will buy

Audit trails are dull. They are also the reason a dispute takes ten minutes instead of a fortnight, the reason an auditor signs off without an extra week of fees, the reason you can answer a POPIA query with confidence, and occasionally the reason a good employee keeps their job.

You will not appreciate it until the week you need it. That is not an argument against it. That is what insurance is.