How to keep an audit trail an examiner will accept

Why the record matters as much as the check

An examiner, auditor or partner bank does not see your checks happen. They see what you can show them afterwards. If you cannot show what was checked, when, against what and who decided, the check may as well not have happened.

A good audit trail turns a stressful request into a routine one: you find the record, export it and hand it over.

What to record for every check

Freezing the evidence

Screenshots and spreadsheets are easy to make and easy to change. That is their weakness. A reviewer has no way of knowing whether a screenshot was taken at the time or recreated later.

Stronger records are sealed as they are made. A common technique is to compute a fingerprint, or hash, of each record and link it to the one before it. If anyone changes an earlier record, its fingerprint no longer matches and every link after it breaks. The change becomes obvious.

The best version lets someone outside your organisation check the seal themselves, with a small tool on their own computer, without needing access to your systems.

Replaying a decision

Months later, someone may ask why you approved a customer. Two questions follow: what did you know then, and would you decide the same way now?

A replayable record answers both. It keeps the evidence and the rules used at the time, so the original decision can be re-run and shown to give the same result. It can also be run against today's lists to show what has changed. Nothing is overwritten; both runs are kept.

Retention and deletion

Records have to be kept for the period your rules require, often five years or more after the relationship ends. At the same time, privacy law says you should not keep personal data longer than needed.

Write down retention periods by record type. Delete what is no longer needed on schedule, keep a log of deletions, and be able to stop deletion with a legal hold when a dispute or investigation is running.

Preparing for the request

Practise. Pick a random customer from last year and try to produce their full record in under an hour. If you cannot, find out why and fix it now, not when the examiner is waiting.

A worked example

An examiner asks for evidence that a business customer onboarded last March was screened, and why a possible match was cleared. The compliance officer searches the customer reference, opens the record and exports it: the screening request, the list dates, the possible match, the date-of-birth conflict that cleared it, the reviewer and the time. The export includes a small verifier the examiner runs on their own laptop. It confirms nothing has changed since March. The request takes fifteen minutes.

What examiners look for

Checklist

A deeper look: what a good record contains

Think of each check as a small file with five parts. The request: who asked, when, for whom, with what inputs. The sources: which lists or registers were searched, with their dates, and which could not be. The results: every match or finding, with scores and reasons. The decision: who decided, what, why, and when. The context: the policy version, any exceptions approved, and links to related checks.

When all five parts are present and sealed, any later question can be answered from the record alone, without relying on anyone's memory.

Questions people ask

Is a PDF report enough? It helps, but a PDF on its own does not prove it was not edited, and it rarely captures the decision. Keep the report together with the decision record and a way to verify integrity.

Can we keep records in spreadsheets? You can, but you will struggle to show they were not changed, and they tend to lose context. If you must, lock and back them up, and record who changes what.

What about records from before we had a system? Keep them as they are, note their limits, and start the new standard from a clear date.

What examiners commonly flag

Building the habit

Good records come from habits, not from a big project. A few practical rules help:

Teams that do this find that examinations, audits and partner reviews take hours rather than weeks, because the answer to almost every question is already written down.

Key terms

Summary

An audit trail is what turns your checks into evidence. Record the request, the sources and their dates, the results, the decision and its reason, and the policy in force. Seal records as they are made so changes are obvious, never overwrite, and let a third party verify an export without access to your systems. Keep records for as long as your rules require, delete on schedule, and be ready to stop deletion under a legal hold. Above all, practise: pick a past case and produce its full record. If it takes more than an hour, fix the process now, while nobody is waiting for the answer. A trail that is complete, consistent and sealed is the difference between a routine request and a stressful one.