An audit log records events; auditability reconstructs the story
An audit log may show that a user changed a value at a particular time. Auditability goes further: it preserves the prior and new state, the user or process responsible, the business context, relevant approvals, related evidence and enough lineage to understand the impact of the change.
Material events worth preserving
- Source imports and processing runs.
- Validation failures and corrections.
- Rule results and overrides.
- Assignment and reassignment.
- Approvals and rejections.
- Status changes.
- Document additions or removals.
- Patient-identity reveal or other privileged access where applicable.
- Financial classification changes.
- Closure and reopen events.
A control result needs context
A control marked “Pass” means the defined test met its configured condition at that time. It does not automatically mean the entire process is risk-free. Reviewers should know the control definition, population, threshold, run time, result and any exclusions.
Overrides need stronger evidence
- Who performed the override.
- What was overridden.
- Why the override was needed.
- Whether approval was required.
- What evidence supports the decision.
- Whether the override changes a financial or operational result.
- Whether follow-up or retesting is required.
Corrective action should close the loop
Issue or control failure is recorded.
Root cause is investigated.
Corrective action is assigned.
Due date and owner are established.
Action is completed with evidence.
The control or process is retested where appropriate.
Effectiveness is assessed and the issue is formally closed.
Retention and change history matter
Organizations should define how long relevant operational, financial and security evidence is retained and how configuration changes are controlled. The appropriate retention period depends on legal, contractual and organizational requirements, so the platform should support policy rather than silently deciding it.