Audit trail
Also called electronic audit trail.
A secure, time-stamped history of who created, changed or deleted a record, kept so the record can be trusted later.
Last updated
What it is.
An audit trail is a stricter cousin of the audit log. It is tied to specific records, such as a lab result, a batch record or a signed form, and shows every version: who changed it, when, and what the old and new values were. Old values are never overwritten.
In FDA-regulated work, 21 CFR 11.10(e) asks for secure, computer-generated, time-stamped audit trails of operator entries and actions that create, modify or delete electronic records. It says changes must not obscure earlier information, and the trail must be kept as long as the record itself.
Why it matters
In regulated fields such as pharma, clinical trials and medical devices, a record without a trustworthy audit trail may not be accepted as evidence. Inspectors read audit trails to check data integrity. Building one in later means migrating history you never kept.
In a product build
We store each change as a new row with actor, time, old value, new value and reason, written by the server in the same transaction as the change. Times come from the server clock, entries are append-only, and the trail can be exported for an inspector.
Common mistakes.
- 01
Recording that a record changed but not what the old value was.
- 02
Using the user's device clock for time stamps.
- 03
Giving database admins a quiet way to rewrite history outside the app.
Read the official text.
Primary sources this definition is based on.
- 21 CFR Part 11, Electronic records; electronic signatures (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- Audit logA record of who did what in a system, when and from where, kept so actions can be traced later.
- Electronic signature (e-signature)A way of signing a document or approving a record electronically, so it carries the signer's intent the way a handwritten signature would.
- GxP (good practice regulations)The family of good practice rules, such as manufacturing (GMP), clinical (GCP) and laboratory (GLP) practice, that regulated life sciences work must follow.
- Maker-checker (four-eyes principle)A control where one person makes a change and a different person must approve it before it takes effect.
- SaMD (software as a medical device)Software meant for one or more medical purposes that does that job on its own, without being part of a hardware medical device.
