ReFresh time-stamps every action across the platform. The audit trail is visible on each entity's Activity Log tab, providing end-to-end traceability from hazard identification through to governance.
Every action is time-stamped
The audit trail covers controls, requirements, evidence, risks, incidents, investigations, consultations, audits, and tasks
Versioning is included for controls, requirements, and evidence
System logs are retained for a minimum of 12 months
Customer data retention follows your contract terms
Where the audit trail lives
The audit trail is exposed on the Activity Log tab of each entity:
A control's Activity Log shows every change to that control
An incident's Activity Log shows every change to that incident and its investigation
A risk's Activity Log shows every assessment update
A document's Activity Log shows version changes, sign-offs, and approvals
There is no global Activity Log page today; each entity carries its own audit trail. (Confirm internally: whether a global organisation-wide audit trail page exists or is roadmap.)
What is recorded
For every action, the trail records:
What changed: the specific field, status, or value
Who changed it: the user (or "System" for automated changes)
When: timestamp
From and To: the previous and new values, where applicable
Why: the comment or reason if one was supplied
For approvals (reviews, sign-offs, evidence submissions), the trail also captures the reviewer's decision, comments, and timestamp.
End-to-end traceability
The audit trail enables end-to-end traceability across the compliance lifecycle:
Identification → Assessment: a hazard's first appearance through to its rating
Assessment → Controls: the controls assigned to mitigate the hazard
Controls → Evidence: the evidence uploaded for each control
Evidence → Review: the approval of that evidence
Review → Governance: the inclusion of the control in board reports
For a regulator, the trail proves continuous management rather than point-in-time effort.
Versioning
Controls, requirements, and evidence carry full version history:
Every approved version is retained
The current version is what counts as evidence
Prior versions are accessible for audit purposes
For documents and policies specifically, the Version History tab shows every version with submitter, approval date, and content.
Retention
System logs are retained for a minimum of 12 months. Customer data retention follows your contract terms; for most customers this is at least the duration of the subscription plus an offboarding window.
Related articles
Compliance snapshots (6.8)
Audit management (6.9)
Compiling an evidence pack for a regulator inspection (6.10)
Policy version control and renewal tracking (4.11)