Document retention: building a useful audit trail

Audit trail is not the same as storage

Record retention answers ‘which data and documents should remain available?’. An audit trail answers a different question: ‘which sequence of events led to the decision?’. That requires timestamps, versions, actor, exceptions, escalation and approvals to be connected.

A minimum decision log

For a material decision it should be possible to reconstruct: event or trigger, information available at that time, control performed, anomaly, challenge/escalation, decision, approver and date. The evidence need not sit in one system, but references should connect.

Micro-case

A customer moves from medium to high risk. The system retains both profile versions but not the trigger or the approver. Storage is complete as a collection of files; decision history is incomplete.

Useful check: select a rating change, override or escalated alert and reconstruct the sequence without relying on personal email or reviewer memory.

Connection with record retention

For data, sources, retention periods and reconstructing the customer file, the complementary topic is the broader AML record-retention analysis. The focus here remains the history of events and decisions.