Platform / The governance core

Audit trail and quality checks

A reviewer asks who changed a score, when, from what and in what capacity. An answer put together afterwards from emails is an assurance, and a reviewer usually wants evidence.

The audit log: entries counted by line of defence, a run of entries and the chain check A drawn view of the platform. Four tiles count the entries written by the first line, the second line and the system. Beneath them, six entries each with a time, a person, a line, a type and a plain description of what changed from what to what. On the right, a chain check reporting that every entry is linked to the one before and the chain is intact. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Audit log This quarter · all entities · append-only Export CSV Entries1,284 First line702 Second line561 System21 WHENWHOLINETYPEWHAT CHANGED, FROM WHAT TO WHAT 09:35RM 2nd line Risk Residual score 12 → 9 on client money reconciliation, reason recorded 09:20IO 1st line KRI Submitted monthly value 3 for open complaints beyond target (v2) 09:04CO 2nd line Pack Approved review step on the group committee pack, as compliance officer 08:51RM 2nd line Action Requested closure of remediation action, awaiting a second person 08:12IO 1st line Control Operating effectiveness assessed: partially effective → effective 02:00SYS System Check Overnight rules run: two findings raised, each naming its rule and evidence Names and roles are held on each entry as they were at the time Chain check Intact every entry linked to the one before checked on demand Nothing edits an entry and nothing deletes one

Drawn from the platform.

What changes

Every change writes who, what, from what to what, when and in what role, and nothing edits or deletes it. A fixed set of rules checks the register overnight and names the evidence behind every finding it raises.

Chained audit entries above a row of overnight checks Four audit entry cards in a row, each recording who, in what role and line, what changed and from what to what, joined by links so that each entry is tied to the one before it. Beneath them, four overnight checks: risks with no controls, controls assessed ineffective, positions outside appetite and reviews gone stale. who · role · line what changed from → to when linked to entry 1 who · role · line what changed from → to when linked to entry 2 who · role · line what changed from → to when linked to entry 3 who · role · line what changed from → to when linked to entry 4 Append-only. Nothing edits an entry and nothing deletes one. OVERNIGHT CHECKS No controls? Ineffective? Outside appetite? Stale review? Each finding names its rule and the evidence that raised it. No model makes a judgement about a risk anywhere in the platform.
Entries linked to the one before, and rules that name their evidence.

In detail

The summary tiles at the top of the audit log in the demonstration organisation: total entries, and the count written by the first line, the second line and the system
The audit log counted by line of defence. Demonstration data.

Every change writes an entry: who, what changed, from what to what, when, the role held at the time and the line of defence. Nothing edits or deletes an entry, and that holds for administrators (and for us) as much as for your users. An auditor gets a full log of evidence.

A fixed set of rules checks the register overnight, and a change to a risk, a control or a breach recomputes the affected findings at once. The rules look for what a reviewer looks for first: risks with no controls, controls assessed ineffective, open and repeat breaches, residual positions outside appetite, stale reviews and actions past their date.

Each finding names its rule and the evidence that raised it. You decide which rules apply and how serious each is. Setting a finding aside needs a written note, and it returns if the evidence does not go away. No model makes a judgement about a risk anywhere in the platform.

The evidence it leaves behind

The record only ever grows, and entries are linked to the one before, so an entry altered after the fact stands out. No record editing without a clear log

Previous: Committee reporting Next: Group and multi-entity structure

See what your reviewers would see

Tell us what your last audit asked for and how long it took to produce, and we will show you the same question answered from the record.

Request a walkthrough Read the security summary

or write to sales@puretrace.co.uk