Skip to main content

Using the audit trail

ReFresh time-stamps every action across the platform. The audit trail is visible on each entity's Activity Log tab, providing end-to-end traceability from hazard identification through to...

Written by Harrison Kennedy

ReFresh time-stamps every action across the platform. The audit trail is visible on each entity's Activity Log tab, providing end-to-end traceability from hazard identification through to governance.

  • Every action is time-stamped

  • The audit trail covers controls, requirements, evidence, risks, incidents, investigations, consultations, audits, and tasks

  • Versioning is included for controls, requirements, and evidence

  • System logs are retained for a minimum of 12 months

  • Customer data retention follows your contract terms


Where the audit trail lives

The audit trail is exposed on the Activity Log tab of each entity:

  • A control's Activity Log shows every change to that control

  • An incident's Activity Log shows every change to that incident and its investigation

  • A risk's Activity Log shows every assessment update

  • A document's Activity Log shows version changes, sign-offs, and approvals

There is no global Activity Log page today; each entity carries its own audit trail. (Confirm internally: whether a global organisation-wide audit trail page exists or is roadmap.)


What is recorded

For every action, the trail records:

  • What changed: the specific field, status, or value

  • Who changed it: the user (or "System" for automated changes)

  • When: timestamp

  • From and To: the previous and new values, where applicable

  • Why: the comment or reason if one was supplied

For approvals (reviews, sign-offs, evidence submissions), the trail also captures the reviewer's decision, comments, and timestamp.


End-to-end traceability

The audit trail enables end-to-end traceability across the compliance lifecycle:

  • Identification → Assessment: a hazard's first appearance through to its rating

  • Assessment → Controls: the controls assigned to mitigate the hazard

  • Controls → Evidence: the evidence uploaded for each control

  • Evidence → Review: the approval of that evidence

  • Review → Governance: the inclusion of the control in board reports

For a regulator, the trail proves continuous management rather than point-in-time effort.


Versioning

Controls, requirements, and evidence carry full version history:

  • Every approved version is retained

  • The current version is what counts as evidence

  • Prior versions are accessible for audit purposes

For documents and policies specifically, the Version History tab shows every version with submitter, approval date, and content.


Retention

System logs are retained for a minimum of 12 months. Customer data retention follows your contract terms; for most customers this is at least the duration of the subscription plus an offboarding window.


Related articles

  • Compliance snapshots (6.8)

  • Audit management (6.9)

  • Compiling an evidence pack for a regulator inspection (6.10)

  • Policy version control and renewal tracking (4.11)

Did this answer your question?