Audit trails and financial controls

An audit trail is the chain that lets anyone follow a reported figure back to the transactions behind it and each transaction back to its source document — and see who did what, and when: who created, approved, posted, changed or reversed each entry. Modern systems keep this as a system-generated log that users can't edit.

Posted entries are corrected, not edited. Once an entry is posted, it has been part of the ledger — perhaps of reports already issued, tax returns filed or balances confirmed to a bank. If it's wrong, the fix is a new entry: - a correcting entry that moves the amount from the wrong account to the right one, or - a reversal of the whole entry (same lines, opposite sides, referencing the original) followed by a correct new entry.

Either way, the original stays visible, the correction has its own date, preparer, approver and explanation, and the periods affected are clear. Editing or deleting a posted entry destroys evidence, makes past reports impossible to reproduce and is exactly what someone hiding a fraud would want to do. Many jurisdictions' record-keeping rules also expect books to be kept without erasures. Well-configured systems simply don't allow it, and lock closed periods so corrections go into an open period.

Key financial controls around the audit trail: - Segregation of duties (SoD) — no one person should be able to initiate, approve, record and reconcile the same transaction, or both maintain master data and process payments to it. - Journal approval workflow — manual journals approved by someone other than the preparer, with thresholds for higher approval; an approved journal that's edited must be re-approved. - Access control — role-based access on least privilege; no shared or generic logins; administrator ("superuser") access limited, logged and reviewed; user access reviewed periodically and leavers removed promptly. - Master data changes — supplier bank changes verified independently (a call-back to a known number) before the next payment run. - Log review — someone independent reviews exceptions: postings to closed periods, edits after approval, high-risk users posting, out-of-hours activity.

Controls are preventive (stop the error: workflow, access rights, period locks) or detective (find it: log review, reconciliations, analytics). Where a small team can't separate duties fully, compensating controls — typically independent review of the output by someone senior — fill the gap. The system-wide controls over access, program changes and IT operations are called IT general controls; automated controls are only reliable if these work.