Audit trails: Track who changed team records and when

A purchase request was approved for Rp12 million. When finance prepares the payment, the amount on the list is Rp14 million. The attached quotation still shows the earlier figure, and the only explanation in the team chat is "updated." You need to decide whether payment can proceed, but you cannot yet explain what changed or who changed it.

An audit trail helps you put those events in order. For an owner or department manager, a record of changes is useful when a figure, responsibility or work status needs checking. You still have to compare it with supporting documents and the authority of the person acting. An account name in a history entry does not explain the business reason for a change.

Start with the record holding up a decision

For example, an operations team requests a pump under record PB/2026/11/0042. The initial Rp12 million covers one pump. The supplier then adds installation components costing Rp2 million, bringing the total to Rp14 million. A purchasing administrator updates the amount after the manager has approved the request, without attaching the revised quotation.

Before changing the amount back or assigning blame, keep the record number, the current amount and the document finance is using. Identify the decision that is waiting: issuing a purchase order, approving the extra cost or paying an invoice. That tells you which part of the history to examine first and what evidence you need to collect.

The NIST glossary definition of an audit trail describes a chronological record used to reconstruct and examine the sequence of activities surrounding an event. That definition comes from a systems security context. The same attention to sequence is useful in departmental work: establish the earlier state, the action taken and the resulting state.

Think of a laundry collection ticket. Its number connects the items handed over with the items collected later, even when several customers bring in similar shirts. A stable record number makes a similar connection between a request and its changes. A matching amount or item description alone can lead you to the wrong request.

What an audit trail needs to show

A note saying "last updated at 10:15" leaves several questions unanswered. For the pump request, you need the event time and time zone, the acting account, the record identifier, the field changed, and its previous and new values. Link the reason for a correction to supporting evidence in the work record or the relevant document.

Time, Western Indonesia Time	Acting role	Record and field	Previous value	New value	Evidence or follow-up
09:05	Operations staff	PB/0042, amount	Empty	Rp12,000,000	Quotation revision 0
09:40	Operations manager	PB/0042, status	Submitted	Approved	Approval for revision 0
10:15	Purchasing administrator	PB/0042, amount	Rp12,000,000	Rp14,000,000	Request quotation revision 1
10:35	Finance manager	PB/0042, follow-up	Not checked	Payment on hold	Review installation addition

The sequence shows that approval came before the amount changed. It does not establish that the installation addition was valid, delivered or approved by an authorized manager. Finance still needs to compare the revised quotation, the item details and the company's approval rules before deciding what happens next.

Keep the event time separate from the document date. An invoice dated November 4 may be entered on November 5; those dates answer different questions. If colleagues work across time zones, put the displayed times on a common basis before reconstructing the sequence. An unexplained one-hour difference can make a straightforward check confusing.

Set out your purchase request approval process by amount before a disputed change occurs. Include what happens when an amount changes after approval: who reviews it again and which documents must be updated. The company needs to define that policy separately from the system's ability to record changes.

Reconstruct the sequence before choosing a correction

Take one event and limit the investigation to the relevant period. Start with the document version used for approval, then follow the changes up to the current state. Reading an entire month's history in one sitting makes it easier to miss the small edit that changed the decision.

1. Match the record identifier to the source document, rather than relying on the request title.
2. Find the first change that made the record differ from that document.
3. Check who acted and what authority they had at the time.
4. Obtain the explanation and revised evidence, then decide whether correction or renewed approval is needed.
5. Record the reviewer's decision and closing evidence before work resumes.

For PB/0042, a reasonable decision could be to hold payment until the revised quotation is available and the additional cost has been reviewed. If Rp14 million turns out to be a typing error, make a traceable correction to Rp12 million. Deleting the earlier change simply to tidy the list removes information the reviewer may need.

Separate responsibility for explaining a change from responsibility for accepting its correction. Those may belong to different people. For a high-risk change such as a payment recipient's bank details, follow the company's verification procedure using an established contact before any transaction. Edit history alone cannot validate a payment destination.

Mistakes that leave a review unfinished

Shared accounts make it difficult to identify the person who acted. An entry attributed to "admin" offers little help when five colleagues use that login. Use individual accounts and assign permissions to match the work, then review role-based access and sensitive fields so that an investigation does not depend on somebody remembering a conversation.

Managers can also assume that an approved status covers every later change. Check what the approval covered at that moment: the amount, quantity, document and scope of work. If an addition changes the original decision, handle it through the company's review procedure. A short message in a group chat may leave the necessary evidence and authority unresolved.

In a warehouse, a changed stock balance still needs an explanation, a location and a movement document. It is not enough to establish that goods physically moved. Connect the review with your warehouse stock movement records, so you can compare the data correction with the physical event and investigate any difference.

Limit who receives the investigation material. Screenshots may reveal purchase costs or staff information that the recipient does not need. Share findings with the roles responsible for the decision, using only the detail they require. Keep supporting evidence in an approved location and apply the document retention rules that govern that work.

Record history and app versions answer different questions

If changes are becoming difficult to follow in a spreadsheet, consider an application built around the team's workflow. The Sora homepage describes audit logs that let owners and administrators see who changed which record and when, including the previous and new values. This can support the PB/0042 review, while the team still checks the business explanation and revised documents.

App version history addresses a different problem. In Sora, proposed app changes can be reviewed before they are applied and are saved as numbered versions. Restoring an earlier app version does not undo records entered afterward. Returning to an earlier column arrangement therefore does not correct an incorrect transaction amount.

Before starting from the options on Sora's apps page, write down the records your team keeps, the roles allowed to edit them and the changes a manager needs to review. You can describe the workflow or upload a spreadsheet, then review the proposed app before applying it. Test it with non-sensitive sample data and check whether the result answers the questions your team actually needs to investigate.

Today, choose one request whose amount or status has changed. Match its record number, reconstruct the sequence and ask an authorized reviewer to check the supporting documents. Close the review with a written decision stating which data is correct, what was corrected and who can continue the work.