Audit Trails and Evidence
What audit logs record, how to read them, why they are append-only, and how they are used during compliance inspections and internal reviews.
What audit logs record
Every consequential action in Growth OS generates an audit log entry. Entries record: who performed the action (actor), what they did (action type), what resource was affected, when it happened (timestamp), and the IP address of the request. Audit entries are written at the time of the action — they cannot be backdated or pre-dated.
Why audit logs are append-only
Append-only means entries can only be added — never edited or deleted. This is a deliberate integrity property. An audit log that can be modified after the fact provides no assurance to an auditor or regulator. The append-only constraint means that if something is recorded, it happened. If something happened that isn't recorded, that's a gap that needs explaining.
Reading the audit log
The audit log displays entries in reverse chronological order. Each entry shows the actor (user ID and role at the time), the action string (e.g. training_assignment.completed), the resource type and ID, and the timestamp. For compliance reviews, you can filter by actor, action type, date range, or resource. Export is available in JSON format for import into compliance tools.
Using audit evidence in inspections
When preparing evidence for an internal review or regulatory inspection, export the relevant date range and action types. The export includes all metadata recorded at the time of the action. Do not summarise or paraphrase audit entries in compliance documentation — export the raw records and let them speak for themselves. If a gap exists in the audit trail, document it honestly rather than attempting to fill it retrospectively.
Portal completion
Assigned users complete this module, assessments, acknowledgements and evidence requirements inside the Lumio-Tek Portal.