Audit trail

What it means

An audit trail is the record that lets someone go back later and see what happened, step by step. Think of a paper expense report. The total on the last page can be checked against each receipt stapled behind it. If a number looks wrong, you follow it back to its source. A dictionary of American English gives the accounting sense as "the process or an instance of cross-referring each bookkeeping entry to its source in order to facilitate checking its accuracy."¹

With AI agents (software that can take actions for a person, not only answer questions), the question an audit trail answers is simple. What did the agent do, in what order, and why?

Where the word comes from

The term started in bookkeeping. Dictionary.com, drawing on the Random House Unabridged Dictionary, lists the accounting sense first and says the term was "First recorded in 1965–70."¹ The same entry gives a computing sense: "a track of a particular item of output data back through the processing steps that produced it to the corresponding input data."¹

Then computer security took up the word. In December 1985 the U.S. Department of Defense's Trusted Computer System Evaluation Criteria defined an audit trail as "A set of records that collectively provide documentary evidence of processing used to aid in tracing from original transactions forward to related records and reports, and/or backwards from records and reports to their component source transactions."² Today the same idea is being applied to AI. Europe's AI law requires certain AI systems to keep automatic records of events, which it calls "logs."³

How others define it

• NIST (the U.S. National Institute of Standards and Technology), in its security controls catalog, SP 800-53 Rev. 5: "A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to result."⁴
• Collins English Dictionary: "a record of all the transactions or data entries that a person or firm has carried out over a specific period."¹
• The EU AI Act, Article 12: "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system."³

Where they agree and differ

All of these definitions describe a record that lets someone go back and check what happened. They differ in what the record is for. The accounting and Collins senses are about tracing transactions and entries.¹ NIST's definition covers the full "sequence of activities" in a "security-relevant transaction."⁴ The EU AI Act asks for something narrower and more technical: systems must "technically allow for" automatic logging. The logging must also be suited to "the intended purpose of the system."³ So a log is the raw material. An audit trail is what lets a person rebuild the story from it.

The strongest objection deserves a fair hearing. A record is not oversight. A trail that no one reads, or that only the vendor keeps and reviews, can make a system look accountable without making it so. We think this objection is right as far as it goes. Our view so far is that an audit trail is necessary but not sufficient: it matters only if a person with authority can open it and act on it. We are watching for cases where trails were kept but missed a problem. Such cases would change our mind about how much weight the word can bear.

In the news

On October 26, ClarityCare announced a $16.5 million Series A for Electra, its AI agent for prior authorization, the step where an insurer approves care before it happens.⁵ The company says the agent "can approve and escalate, but it never issues a denial," and that it "keeps a full audit trail of how it reached each recommendation."⁵ These are the company's own claims, from its own blog.

On November 3, FinSMEs reported that Marrow, a London-based startup, raised $2 million to build insurance sales infrastructure for AI agents.⁶ According to the report, the platform "records verified audit trails to ensure autonomous, agent-led insurance purchases strictly adhere" to the UK's Consumer Duty rules.⁶ This is also the company's description as reported, not an independent test.

In both stories, the audit trail is offered as the reason to trust an agent with consequential decisions about people's health care and money.

What it means for your organization

When a vendor says its agent keeps an audit trail, the word alone tells you little. NIST's standard asks whether the record can rebuild the sequence "from inception to result."⁴ Ask the same of any agent you deploy. Can a person on your side, not only the vendor, open the trail and see what the agent did, on whose instructions, and why? If no one is assigned to read it, you have a log, not a check.

One question to ask your team: If one of our AI agents made a wrong decision yesterday, who would open the record, and how long would it take them to trace what happened?