An audit trail is a time-ordered record of who changed what, when and, ideally, why: enough to rebuild how a record or a figure reached its current state. A national standards body's security glossary gives the current definition: "A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to result".
Two uses
That definition is framed around security: who logged in, who changed a supplier's bank details, who approved a payment. The second use matters as much in a timber business: explaining why a number changed.
Figures change after they are reported. Scale tickets arrive late, rates are corrected, credits are issued, accruals are replaced by invoices. Even audited statements change. Accounting Today, reporting Ideagen Audit Analytics, noted 391 restatements in 2025, the second-lowest count in twenty years. Management figures change far more often.
What a good one records
The record changed, the old and new values, who changed it, when, through which system, and the reason. For automated changes, such as imports and AI-assisted updates, it records the source and the rule applied. And the people whose changes it records can't edit it.
For a derived figure, such as a margin in a report or a number in an AI answer, the trail has to reach further: from the reported number back through its calculation to the source rows that changed. That is where data lineage and the audit trail meet.
In a timber business
Most ERPs and accounting packages keep their own change logs. In our experience the gap is between them: a figure built from several systems, or from a spreadsheet that keeps no history, has no single trail.
What it isn't
An audit trail isn't a backup, which keeps copies without saying what changed. Nor is it an approval process, though it records approvals.
What to check
Pick a figure that changed last month and ask to see every change behind it, with reasons, across every system it came from.
Quarri's security page sets out how customer data is isolated, encrypted and audited.
Sources
- NIST Computer Security Resource Center, glossary, "audit trail" (definitions from CNSSI 4009-2022 and NIST SP 800-53 Rev. 5): csrc.nist.gov
- Hood, "Financial restatements drop 18%", Accounting Today, 5 June 2026 (reporting Ideagen Audit Analytics): accountingtoday.com
Quarri is an AI-native data platform for the timber supply chain. It connects buying, production, sales and inventory for forest management, sawmill, wood products and pulp, paper and packaging operators.