In regulated activities, what counts is not what was done but what can be proven. The audit trail is the technical memory for that. It records who opened a client file, changed a risk classification, approved a payment or replaced a document — with time and context.
What must be logged
At minimum the acting person, the time, the affected file or record, the type of action and, for changes, the previous and new value. For approvals, additionally who approved and on what basis. For access to particularly sensitive data, read actions too. A log that only says something changed, but not what, is worthless in an audit.
Immutability
An audit trail that administrators can edit after the fact proves nothing. Good implementations only ever append entries and never rewrite them, separate logs from operational data and protect them against deletion. Corrections are made as new entries that leave the error visible. It is the same logic as in accounting: reverse, don’t erase.
Retention
The Swiss Anti-Money Laundering Act requires financial intermediaries to document their enquiries so that qualified third parties can form a reliable judgement, and to keep the records for at least ten years after the end of the business relationship or completion of the transaction (Art. 7 AMLA). The audit trail is part of that documentation and must therefore stay readable that long, including across system changes.
The data protection angle
Data protection law also contains logging requirements, especially for automated large-scale processing of sensitive personal data. At the same time, an audit trail itself contains personal data — about clients and staff. Access to the logs must be restricted just like access to the files.
Typical weaknesses
Shared accounts where nobody can tell who acted. Work outside the system, in spreadsheets and emails, that leaves no trail. And a trail that technically exists but cannot be evaluated, because nobody can map the entries to a file. A usable audit trail answers the question of how a decision was reached in minutes, during an SRO audit or a KYC remediation. It complements the four-eyes principle, because it shows whether the second person actually checked.