Audit trail

An audit trail links every change, approval or decision to a person or system, a timestamp, the previous and the new state and, where relevant, the reason. MaRisk requires business, control and monitoring records to be prepared systematically, to be traceable for knowledgeable third parties and to be retained for five years. In Switzerland, the Code of Obligations requires business records to be retained for ten years.

For high-risk AI systems, the EU AI Act requires automatic logging of events over the system’s lifetime, and both providers and deployers must keep these logs; financial institutions keep them as part of the documentation required by financial services law. For executives, a reliable audit trail is what turns a claim of compliance into evidence that withstands supervisory review.

Pitfalls include logs that record technical events but not business decisions, trails that can be edited by the administrators they are meant to monitor, gaps where data moves between systems, and retention periods that end before the records are needed.

In practice

1. 01
   Records user, timestamp, action, old and new values and, for approvals and overrides, the stated reason.
2. 02
   Protects trails against alteration and separates the administration of the trail from the activities it records.
3. 03
   Keeps identifiers stable so that a policy, control, model or decision can be traced across versions.
4. 04
   Defines retention per record type in line with the longest applicable legal requirement.
5. 05
   Tests periodically that a complete history can actually be reconstructed for a sample of decisions.

Sources

• BaFin Circular 06/2026 (BA), Mindestanforderungen an das Risikomanagement (MaRisk), 30 June 2026 →
• Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act) →