{"head":{"title":"What Is an Audit Trail? Regulated Records Explained","description":"An audit trail is a secure, time-stamped record of every change to a regulated record. What FDA Part 11 asks for, an example and the mistakes teams make.","canonical":"https://oceanlab.in/glossary/audit-trail"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"audit trail","path":"/glossary/audit-trail"}],"slug":"audit-trail","term":"Audit trail","aka":["electronic audit trail"],"category":"Compliance","short":"A secure, time-stamped history of who created, changed or deleted a record, kept so the record can be trusted later.","body":[["An audit trail is a stricter cousin of the ",{"href":"/glossary/audit-log","text":"audit log"},". It is tied to specific records, such as a lab result, a batch record or a signed form, and shows every version: who changed it, when, and what the old and new values were. Old values are never overwritten."],["In FDA-regulated work, 21 CFR 11.10(e) asks for secure, computer-generated, time-stamped audit trails of operator entries and actions that create, modify or delete electronic records. It says changes must not obscure earlier information, and the trail must be kept as long as the record itself."]],"why":["In regulated fields such as pharma, clinical trials and medical devices, a record without a trustworthy audit trail may not be accepted as evidence. Inspectors read audit trails to check data integrity. Building one in later means migrating history you never kept."],"example":["In a lab system, a technician corrects a sample weight from 10.2 g to 10.4 g. The record shows the new value, and the audit trail keeps the old value, the technician's name, the time and the reason they typed in. Nobody, including admins, can edit that entry."],"inBuild":["We store each change as a new row with actor, time, old value, new value and reason, written by the server in the same transaction as the change. Times come from the server clock, entries are append-only, and the trail can be exported for an inspector."],"mistakes":[["Recording that a record changed but not what the old value was."],["Using the user's device clock for time stamps."],["Giving database admins a quiet way to rewrite history outside the app."]],"related":[{"href":"/glossary/audit-log","label":"Audit log","detail":"A record of who did what in a system, when and from where, kept so actions can be traced later."},{"href":"/glossary/e-signature","label":"Electronic signature (e-signature)","detail":"A way of signing a document or approving a record electronically, so it carries the signer's intent the way a handwritten signature would."},{"href":"/glossary/gxp","label":"GxP (good practice regulations)","detail":"The family of good practice rules, such as manufacturing (GMP), clinical (GCP) and laboratory (GLP) practice, that regulated life sciences work must follow."},{"href":"/glossary/maker-checker","label":"Maker-checker (four-eyes principle)","detail":"A control where one person makes a change and a different person must approve it before it takes effect."},{"href":"/glossary/samd","label":"SaMD (software as a medical device)","detail":"Software meant for one or more medical purposes that does that job on its own, without being part of a hardware medical device."}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/compliance/21-cfr-part-11","label":"21 CFR Part 11 guide","detail":"FDA rules for electronic records and signatures."},{"href":"/software/pharma","label":"Software for pharma","detail":"Life sciences systems and validated software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"sources":[{"title":"21 CFR Part 11, Electronic records; electronic signatures (eCFR)","url":"https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}