What does the law require an electronic records system to log in its audit trail?

An audit trail is the system-generated history of what happened to a record and who was responsible. While the exact wording varies across laws, regulations, and standards, the underlying requirement is consistent: an electronic records system must capture enough information to prove that records are authentic, reliable, and unaltered over time. In practice, that means logging the key events in a record’s life and the context surrounding them.

Core events the audit trail should capture

Most recordkeeping requirements expect the system to log events such as:

• Creation and capture — when a record entered the system and how.
• Access and viewing — who opened or retrieved a record, and when.
• Modification — any change to the record’s content or metadata, with before-and-after detail where feasible.
• Movement and reclassification — transfers between folders, categories, or retention schedules.
• Disposition — holds, transfers, and destruction, including the authority for each action.

The goal is a complete, sequential picture of a record from capture through final disposition.

Required details for each event

For each logged action, the audit trail generally needs to record:

• Who performed the action (the authenticated user or system process).
• What action occurred.
• When it happened (a reliable date-and-time stamp).
• What changed, when content or metadata was altered.

Integrity of the log itself

The audit trail is only useful if it cannot be quietly edited. Standards and agency guidance expect the log to be tamper-resistant, retained for as long as the records it documents (or longer), and protected from unauthorized deletion. Audit data is itself a record and should be managed under its own retention and security controls.

Why it matters

These logs are what let an organization demonstrate chain of custody, support legal discovery and FOIA or privacy requests, and prove that destruction followed an approved schedule. Without a trustworthy audit trail, an electronic record’s evidentiary value can be challenged.

Specific obligations differ by jurisdiction, sector, and the standards an organization adopts, so map your audit requirements to the laws and policies that govern your records. For broader context, see the electronic records topic hub.