An audit log is a record of events written by a system. An audit trail links those events into a traceable story of who did what and when. Audit evidence is the selected, explained record you give an auditor to show a control operated. Logs are raw material, trails add context, and evidence adds proof and scope.
Definitions side by side
| Term | What it is | Example | Who reads it |
|---|---|---|---|
| Audit log | Time-ordered events from one system | Source control audit log entry: branch rule changed | Engineers, investigators |
| Audit trail | Events across systems tied to one subject | Ticket, PR, approval, pipeline run and deploy for one change | Reviewers, auditors |
| Audit evidence | Selected records plus explanation, tied to a control and a period | Export of all production changes in Q3 with the approval link for each | Auditors |
A log can exist with no trail, if nothing connects its entries to others. A trail can exist without being evidence, if nobody has selected, dated and explained it.
Why the distinction helps
When an auditor asks for evidence, handing over raw logs makes them do the connecting. They may not understand your systems, and a large log is hard to sample. Evidence is the log made useful: filtered to scope, linked to a control, with a note on how it was produced.
From log to evidence
- Turn logging on. Many platforms keep some events by default, but check what is off by default and how long it is retained. GitHub's organization audit log, for example, covers the last 180 days, so older events need to be exported before they age out.
- Add identifiers that connect systems, such as ticket numbers in commit messages and PR titles.
- Build the trail: for each change, link ticket, review, checks and deploy.
- Pick the scope for a control and period, and export the matching records.
- Add a short description: system, query, run date and who ran it.
- Store it with a date and make it read-only.
What makes a trail good
- Every actor is a named person or an identified service account.
- Times are in one standard, such as UTC.
- Entries cannot be edited, or edits are themselves logged.
- The path from request to result has no gaps.
What breaks a trail
- Shared accounts, so the actor is unknown.
- Retention shorter than the audit period.
- No common identifier between ticket and code.
- Logs kept by the same person who could change them.
Quick check
Is a screenshot of a log evidence?
It can be, but an export with the query, date and a hash is stronger and easier to sample.
How long should logs be kept?
At least through the audit period and your policy's retention window. Check platform limits and export earlier if needed.
Who owns the trail?
The control owner is accountable. Engineering usually builds and maintains the plumbing.
Safeguard compliance and evidence automation helps turn scan and review records into dated evidence. A free scan shows an example.
Sources
Last reviewed: 19 October 2026.
