Finance Operations and Controls
What Is an Audit Trail and Why Does It Matter?
An audit trail records who did what, and when. Why it matters for fraud, tax queries and disputes, what a good one captures, and what it can't prove on its own.
An audit trail is a time-ordered record of who did what to a transaction, and when. It's the answer to the question every finance team eventually hears: "Who approved this?" Without one, the answer depends on someone's memory. With one, it takes seconds.
A definition you can use
In a finance system, every meaningful action leaves an entry: an invoice raised, a voucher approved, a salary changed, a payment recorded. Read together, those entries tell the story of a transaction from start to finish.
A spreadsheet doesn't do this. It keeps the latest value in a cell, not the history behind it. If a salary changed from ₦450,000 to ₦540,000, the spreadsheet shows ₦540,000 and nothing else.
What a good entry captures
Not every log is a useful audit trail. A good entry answers six questions.
| Question | Example |
|---|---|
| Who | Chiamaka Obi (accountant) |
| Did what | Approved |
| To which record | Invoice INV-2026-0418 |
| When | 03 November 2026, 09:41 |
| What changed | Status: In review → Awaiting final approval |
| Why, where it applies | Returned items: "Wrong billing period" |
The "what changed" column matters most for edits. An entry that says "Aisha Bello edited employee record" is far less useful than one showing that the basic salary changed from ₦450,000 to ₦540,000.
Two further properties make a trail trustworthy:
- Entries can't be edited or deleted by the people they describe. A log the user can tidy up isn't evidence.
- Every user has their own login. Shared logins ("accounts@" used by three people) make "who" meaningless.
Four moments when it matters
The payment nobody remembers approving
A ₦2,750,000 voucher for office rent in Garki was paid twice. With an audit trail, finance can see that the second voucher was raised by a different person three days later, reviewed by someone who didn't check for duplicates, and approved at 6:40 p.m. on the last working day. That points to a fix: a duplicate check in the review step. Without it, you have a loss and a guess.
The customer who disputes an invoice
A customer says they never agreed to a rate change. The trail shows the invoice was raised at ₦80,000 per learner, returned by the reviewer with the note "Rate is ₦85,000 per new contract", corrected and approved. That's a useful conversation to be able to have with facts.
The tax query
When the tax authority asks how a VAT figure was arrived at, you need to show the invoices behind it, and that those invoices weren't altered after they were reported. A trail that shows when each invoice was approved, sent and paid makes that much easier to demonstrate. For what your VAT records should show, see VAT in Nigeria.
The employee who asks why their pay changed
"My net pay dropped by ₦25,000 this month." The payroll trail shows a staff loan deduction began in this run, approved on 24 October. A two-minute answer instead of an afternoon of digging. Our guide to payslips in Nigeria covers what employees should be able to see.
What an audit trail can't do
It's worth being clear about the limits.
- It records actions, not intentions. It shows that Tunde Bakare approved a payment. It doesn't show whether he read the attachment.
- It doesn't prevent mistakes. It makes them visible and traceable. Prevention comes from the approval workflow and separation of duties.
- It's only as good as the access controls. If people share logins, the "who" is unreliable.
- It doesn't cover what happens outside the system. A cash payment agreed in a corridor leaves no entry anywhere.
Making an audit trail useful in practice
- Give every person their own login, and remove access the day someone leaves.
- Route invoices, vouchers, pay runs and loans through approvals, so the key decisions are recorded as actions, not chat messages.
- Require a written reason when something is returned or rejected.
- Decide who can read the audit log. Usually: finance leadership and internal audit.
- Review a sample each month: pick five large transactions and read their trail end to end.
- Keep records for as long as the law and your auditor require. Confirm the current retention period with your accountant or tax adviser.
Audit trail or audit log?
The terms are often used interchangeably, but there's a useful distinction. An audit log is the raw list of entries: every action, in time order, across the system. An audit trail is the path you follow through that log for one transaction, such as everything that happened to INV-2026-0418 from the moment it was raised to the moment its receipt was issued. Auditors read trails. Systems keep logs. You need the log to be complete for the trail to be believable.
The connection to approvals
An audit trail and an approval process are two halves of one control. The approval process decides who must act before money moves. The audit trail proves that they did. If you're designing the first half, see How to Design an Invoice Approval Process.
How Flux helps
Flux keeps an audit log across invoices, vouchers and payroll, with a dedicated payroll audit trail for pay runs. Every user has their own login and role, the person who raises an invoice can't approve it, and returned items go back to the raiser. Invoices, vouchers, pay runs and staff loans all pass through approval steps, so the trail records who asked, who approved and what was paid. See Platform & Control.