Trace and audit

The test of an access arrangement is a question asked months later: who reached that system in June, under whose authority, and what did they change? Trace and audit work is how a client answers that question from their own records, calmly and quickly.

What a good record answers

We design records around the questions clients actually receive from auditors, insurers and boards, rather than around what happens to be logged by default.

• Who. The named person, their role, and the authority that admitted them.
• When. Start, end and duration, in a time zone the client declares in advance.
• Where. The system reached and the location the session began from.
• Why. The brief, ticket or approval that justified the session.
• Result. What changed, what was tested, and what was left open.

Designing records people will keep

Records are abandoned when they are hard to read. We favour a small number of durable, plain-text-friendly outputs: a session index, a change log and a review note. Each is designed to be read by a human first and processed second. Retention periods are agreed with the client and written into the register, so records are neither kept forever by accident nor deleted before a question can be answered.

Reconstruction drill

Once a year, with the client, we run a reconstruction: pick a date at random, and rebuild that day's access picture from client-held records alone. The drill exposes the difference between what an arrangement claims to record and what it truly records. It takes an afternoon and has saved clients from more uncomfortable conversations than any other single exercise we perform.

Findings and repair

Audit work frequently finds the same small set of gaps: sessions that were never linked to an approval, changes recorded in a chat thread rather than a log, and a time-zone disagreement between two systems. Each has an inexpensive remedy. We list them, estimate the effort, and let the client decide the order.

Working with your auditor

Where a client has an external auditor, we prepare a short evidence pack and a map from the auditor's questions to the records that answer them. We attend review meetings at the client's request and answer technical questions in writing. The auditor's independence is untouched: our job is to make the client's own evidence easy to examine, not to argue on the client's behalf.