Audit Trails - Document Management Information
Every business should maintain a comprehensive audit trail of the precise sequence of actions and events for their work processes, that form a complete record of what has been done and who has done it. This will help when auditors (and potentially lawyers) seek to determine the company policies and practices that were in effect at a given time.
Good audit trails will allow you to undertake retrospective studies of business performance; will prevent repeat work from being undertaken; provide protection of liability from the errors of others; protect your intellectual property; provide a learning history to facilitate the replication of activity. They will help if you are involved in reviews or investigations at the request of customers, suppliers or former employees.
The audit trail should include:
Correspondence sent and received
Telephone calls made and received
Email in and out
Actions taken and decision made
Meetings held
You should assess carefully what needs to be captured to provide your audit trail, whether in paper or electronic format. For example, for important outgoing telephone calls, the member of staff should record their name, the matter, the date and time, the name of the person called and a description of the discussion. If the call required prior authorisation, details of this should also be recorded. This will ensure that an accurate record is captured.
This record should then be retained so that:
It complies with any legal or regulatory requirements for retention
Its content, meaningful context (circumstances of creation and relationships) and the structure (logical and physical attributes) are maintained
It remains authentic and can be trusted
It is securely maintained to prevent unauthorised access, alteration or removal
That it can be accessed and interpreted through time
That it cannot be repudiated
If audit trail records are held electronically, it is important to ensure that unalterable system audit trails are provided to record the User, Date, Time, Action and Results. Especially for electronic commerce applications, the complete "visual presentation" of the transaction/record must be retained.
