Audit Trail

An audit trail is the cross-referenced record that lets any amount in a set of financial statements or on a tax return be traced back to the source document behind it, and lets any source document be traced forward into the totals it lands in. It sits in the client’s own books, spread across the general ledger, the subledgers that carry the detail behind a ledger account, the journal entries and the documents those entries point at. It exists whether or not the business is ever audited, because it is a property of how the records were kept rather than something an auditor brings along.

What the Trail Has to Connect

The underlying duty is to keep records, not to keep a trail. Section 6001 of the Internal Revenue Code puts the recordkeeping duty on every person liable for any tax imposed by the title, or for the collection of it (26 U.S.C. 6001), and the regulation under it names the record for persons subject to income tax: permanent books of account or records sufficient to establish what a return has to show (eCFR, 26 CFR 1.6001-1(a)). Both are worked through in bookkeeping, and being able to say what an amount is made of is what satisfying that standard looks like from inside the ledger.

The IRS uses the term itself once the records are electronic. A taxpayer storing books and records in an electronic storage system has to keep information that supports those books and records, and the rule’s own example is the link: the stored information and the taxpayer’s books and records must be “cross-referenced in a manner that provides an audit trail between the general ledger and the source document(s)” (Revenue Procedure 97-22, section 4.01(4)). What that storage system has to do beyond the cross-reference is worked through in invoice processing automation.

For computerized records the reconciliation has to hold against two things. Machine-sensible records, meaning data in an electronic format intended for use by a computer, must provide enough information to support and verify the entries made on a return and to determine the correct tax liability, and they meet that requirement only if they reconcile with the taxpayer’s books and with the taxpayer’s return. The relationship a taxpayer demonstrates to establish that reconciliation, which the procedure names as the audit trail, runs from the account totals in those records to the account totals in the books, and from the same totals to the return (Revenue Procedure 98-25, section 5.01(2)).

A Worked Trace

Say a client’s payables close a month with three open vendor invoices, one of which you want to follow.

Source document   Vendor invoice 4471, dated March 12          4,200
Journal entry     JE 318  debit  Repairs and maintenance 6400  4,200
                          credit Accounts payable 2000         4,200
Subledger         Accounts payable, open items
                    invoice 4471                               4,200
                    invoice 4482                               1,150
                    invoice 4495                                 860
Trial balance     Accounts payable 2000                        6,210

Read it downward and the invoice arrives at one line of the trial balance. Read it upward from that line and the balance resolves into open items, one of which is the invoice you started with, sitting in the accounts payable subledger. The chain holds only because the journal entry carries the invoice number. Strip that identifier out and every figure still balances, and the link that made the trace a trace is gone.

What an Audit Trail Is Not

The separation worth making first is from the auditor’s own file. Audit documentation, the workpapers, is created by the auditor during the engagement and retained by the firm whose report goes out, under its own retention rule set out in outsourced audit support. The audit trail belongs to the client and was there before the auditor arrived.

An IRS audit is a different thing entirely. It is a review or examination of an organization’s or individual’s books, accounts and financial records to make sure information is reported correctly under the tax laws and to verify the reported amount of tax (IRS, IRS audits). The trail is what such an examination reads, not the examination.

A reconciliation is a procedure rather than a record. It proves that two records agree at a point in time, which is a narrower question than whether one amount can be followed to the documents behind it, and the mechanics of the common case are in bank reconciliation.

The change log inside an accounting system is one implementation of the idea and not the definition of it. Ledger systems record who changed a field, when, and what the value was before and after, which is useful evidence. Logging under the SOC 2 trust services criteria, the subject of SOC 1 vs SOC 2, sits in the same family and answers a different question: who reached the system, rather than what an amount is made of.

Paper trail is the everyday phrase for the same idea. It is not a defined term in the auditing standards, which define accounting records instead.

Common Questions

Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can put a block of its own bookkeeping through a trial task before anything client facing depends on the trail it leaves.