Audit Trail Requirements: What to Log and How Long to Keep It

There is no single U.S. law that sets one audit trail standard for everyone. The requirements depend on your sector and the records involved: FDA rules for regulated electronic records, HIPAA for systems that handle electronic protected health information, and federal control frameworks such as FedRAMP and IRS Safeguards. Across all of them the core idea is the same. A trustworthy audit trail is a secure, time-stamped record of who did what, when, and with what result, and it cannot be quietly rewritten.

This guide sets out what the main rules actually say, then applies them to a workplace visitor and contractor register, where a good audit trail is also your evidence in an emergency or an incident review.

TL;DR

• An audit trail records the event history, not just the final status: the actor, the action, the timestamp, the location, and the outcome.
• FDA 21 CFR 11.10(e) requires secure, computer-generated, time-stamped trails for regulated electronic records. Changes must not hide earlier entries.
• HIPAA requires mechanisms that record and examine activity in systems using ePHI, and it expects every action to trace to a unique user.
• No universal retention period exists. Set a documented schedule based on the rule, record type, contract and legal holds that apply to you.
• For visitor sign-in, log failed sign-ins, manual edits, deletions, badge reprints and roll-call changes, not only check-ins.

Table of Contents

• What an audit trail is, and what it is not
• FDA 21 CFR Part 11: the best-known standard
• HIPAA: audit controls in healthcare
• General baselines: FedRAMP, IRS and state standards
• Retention: there is no universal number
• What a visitor and contractor audit trail should contain
• Technology controls that make a log trustworthy
• Our perspective
• Applying this to your sign-in process
• How EntryWatch fits
• FAQ
• Sources

What an audit trail is, and what it is not

The IRS describes an audit trail as a chronological sequence of audit records, each holding evidence of a business process or system function, in its Safeguards audit guidance. FDA data-integrity guidance uses a similar definition: a secure, computer-generated, time-stamped record that lets you reconstruct how an electronic record was created, modified or deleted.

Two things follow from that.

1. It is a history, not a status. A register that only shows “signed out at 4:52 pm” is a snapshot. An audit trail also shows that the time was edited at 5:10 pm, by whom, and what it said before.
2. It is evidence, so it needs protection. If an administrator can silently rewrite entries, the log proves nothing. The AWS DevOps guidance on audit trails makes the same point: restrict access to authorized reviewers, prevent unauthorized deletion or alteration, and keep time synchronized.

FDA 21 CFR Part 11: the best-known standard

If you search this topic, Part 11 dominates the results. It applies to electronic records and signatures used in FDA-regulated activity: drug, device, biologics and food manufacturing, clinical work and similar.

Under 21 CFR 11.10(e), you must use secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete electronic records. Three details matter:

• Record changes must not obscure previously recorded information.
• The audit trail documentation must be kept at least as long as the electronic records it covers.
• It must be available for FDA review and copying.

The same section also expects validated systems, accurate human-readable and electronic copies, authorized access, operational and authority checks, trained personnel, and written accountability policies.

Does Part 11 apply to every sign-in system?

No, and it is worth being precise. FDA’s Part 11 scope and application guidance says enforcement discretion may apply to some provisions, including validation and audit-trail provisions, in specified circumstances. Predicate-rule obligations still apply. Whether Part 11 touches your visitor register depends on whether those records are used in an FDA-regulated activity, such as a cleanroom or production-area access log that forms part of a batch record.

If you are unsure, ask your quality or regulatory affairs lead. Do not assume either way.

How often should audit trails be reviewed?

FDA’s data integrity guidance says audit trail review should generally follow the review frequency for the underlying CGMP record. Where regulations do not set a frequency, you decide using a documented risk assessment that weighs data criticality, existing controls and the potential effect on product quality. So there is no automatic daily task. There is a documented, reasoned schedule.

HIPAA: audit controls in healthcare

For U.S. covered entities and business associates, the HIPAA Security Rule’s technical safeguards require mechanisms that record and examine activity in information systems that contain or use ePHI. HHS audit materials also expect unique user identification, so activity traces to one person and logs can support periodic access review.

The HHS audit protocol shows why shared accounts are a weakness. A generic administrator login or a shared kiosk account means you cannot attribute an action to a specific person, which weakens the evidence.

A practical point for hospitals and clinics: a visitor register does not need clinical information just because the site is a healthcare facility. If the system holds or uses ePHI, apply your HIPAA security analysis. If it does not, keep the visitor record to the minimum needed for safety, access and accountability. Fewer fields means less to protect and less to explain to an auditor. Our page on contactless visitor access for healthcare covers how sign-in works in those settings.

You may also see claims that HIPAA mandates a six-year retention period for audit logs. HIPAA’s documentation requirements carry a six-year expectation for certain compliance documents, but state laws and your own policy may differ, so confirm the period with your compliance officer rather than relying on a blog summary.

General baselines: FedRAMP, IRS and state standards

Outside FDA and HIPAA, most organizations borrow from federal control catalogs. These are the most concrete lists of what a log entry should contain.

FedRAMP’s audit and accountability controls say audit records must establish what type of event occurred, when, where, the source, the outcome, and the identity of associated individuals, subjects or objects. Maryland’s audit and accountability standard adds operational points: define audit scope and sources, estimate log volume, define retention, calculate storage needs, and respond when logging fails or capacity runs out.

The IRS Safeguards guidance expects successful and failed authentication, privileged-user activity, changes to access rights, account and privilege changes, audit-service changes, system start and stop events, and creation, modification or deletion of objects. It also states a six-year retention expectation for audit information covering federal tax information. That figure belongs to that program. It is not a general rule.

Retention: there is no universal number

This is the question people most want answered, and the honest answer is that it depends. Retention comes from the applicable regulation, the record type, contracts, legal holds and your own policy. The NIST-derived AU-11 principle, which the IRS guidance reflects, is to keep records for an organization-defined period consistent with legal, audit, administrative and operational needs.

In practice:

1. Write a retention schedule. List each log type, the rule or reason behind its period, and who owns it.
2. Preserve on hold. Records tied to an investigation, claim or legal hold stay until released, whatever the schedule says.
3. Match the underlying record. Where a rule like 21 CFR 11.10(e) applies, keep the audit trail at least as long as the record it covers.
4. Plan storage. Estimate log volume and capacity so logging does not fail silently.

For visitor logs specifically, a UK government guide on managing visiting workers and contractors is a useful practical model, though it is UK public-sector guidance and not a U.S. or worldwide retention rule. It expects a record of who visiting workers are, the purpose of the visit, where they are working, whether they had an induction briefing, and times in and out, with identifiable hosts and sign-in and sign-out arrangements.

What a visitor and contractor audit trail should contain

Most visitor books capture the easy part: name, company, time in. The harder and more valuable part is the surrounding history. Pulling the frameworks above together, each event should record:

Events teams forget to log

The common mistake is logging the check-in and nothing around it. Apply the IRS principle to your register and include:

• Failed sign-in attempts
• Manual overrides and corrections, with a reason
• Edits and deletions of existing records
• Badge reprints
• Changes made during an emergency roll call
• Administrator actions, including permission changes

A correction should add a new entry that shows the original value, the new value and the person who changed it. It should never replace the original.

Technology controls that make a log trustworthy

A log is only as good as its protection. Look for these controls in any system you use, whether it is a visitor platform, a time clock or a ticketing tool:

• Unique accounts and role-based permissions. No shared admin or kiosk logins.
• Append-only or tamper-evident storage. Entries cannot be edited in place. For a deeper look at write-once logging, see this explanation of WORM logs for time tracking audit trails.
• Reliable time source. Timestamps from the system, not typed in by the user.
• Failure monitoring. An alert when logging stops or storage runs low.
• Export and copy. You can produce readable copies for an auditor, regulator or insurer.

Our perspective

We build visitor management software, so we see audit trails from the front desk, not the lab. Most sites we talk to are not chasing a specific regulation. They want to know who is on site right now, who was here last Tuesday, and what they signed. That is a live occupancy register with a history behind it.

We think three habits matter more than any feature list. First, capture the record at the point of arrival, through a self-service kiosk or QR code, so it does not depend on someone remembering to write it down. Second, keep the history intact: edits and deletions should leave a trace. Third, decide what you will not collect. A visitor record that holds only what safety and access require is easier to defend.

We also think claims should be careful. A visitor system can support your compliance obligations, but whether a particular regulation applies to your site is a question for your compliance, quality or legal team. We would rather say that plainly than overpromise.

— Flipmind

Applying this to your sign-in process

Here is a short sequence for a facilities, operations or health and safety manager.

1. Identify which rules apply. FDA predicate rules, HIPAA, a customer contract, a government program, or only internal policy.
2. Define the scope. Decide which events count: visitors, contractors, staff, forms, badges, roll calls.
3. Set contents. Use the actor, event, time, place, outcome and object fields above.
4. Assign review. Name who reviews the trail, how often, and why. Document the risk reasoning.
5. Write the retention schedule. Include legal hold handling.
6. Test an export. Ask for the last 30 days of one kiosk, and confirm it is readable and complete.
7. Test an emergency. Run a drill and check the roll call reflects who was actually present.

How EntryWatch fits

EntryWatch gives workplaces a visitor management system with contactless sign-in and sign-out for visitors, contractors and employees, a real-time and auditable record of entries, detailed visitor history, and automatic emergency roll calls. Digital forms such as NDAs, health declarations and site rules are signed at arrival, and contractor inductions and document expiry are tracked in the same place. You can add visitor badge printing and resold kiosk stands and badge printers to complete the front desk.

Founding customers currently get the complete platform with all features included free until 2027. You can see the details on the Founding plan page.

FAQ

What should an audit trail contain?

It should show what happened, when, where, from what source, with what outcome, and who or what was involved. FedRAMP’s audit controls use that structure. For a visitor register, that means the actor, event type, timestamp, kiosk or site, outcome and the affected record.

How long must audit trails be kept?

There is no single period. It depends on the regulation, record type, contracts, legal holds and your policy. Under 21 CFR 11.10(e), the audit trail must be kept at least as long as the electronic record it covers. Write down your schedule and confirm it with your compliance team.

Do audit trails need to be reviewed regularly?

Usually yes, but the frequency should be reasoned. FDA guidance says review should follow the frequency for the underlying record, and where none is specified, a documented risk assessment sets it. HIPAA also expects you to examine system activity, not just collect it.

Does a visitor sign-in system fall under 21 CFR Part 11?

Only if its records are used in an FDA-regulated activity. FDA’s scope guidance ties applicability to the predicate rules and describes enforcement discretion for some provisions. Ask your quality or regulatory lead whether your visitor or access records feed a regulated record.

Sources

• eCFR: 21 CFR 11.10, Controls for closed systems
• FDA: Part 11 scope and application
• FDA: Data integrity guidance for industry
• HHS: HIPAA combined regulation text
• HHS: HIPAA audit protocol
• FedRAMP: Audit and accountability controls
• Maryland DoIT: Audit and accountability standard
• IRS: Meeting IRS Safeguards audit requirements
• AWS: Establish comprehensive audit trails
• UK government: Managing visiting workers and contractors

Recommended

• 12 Week Audit Readiness Checklist for Finance Teams: With IT Trails
• Audit Ready Contractor Management ISO 45001: Procurement to Daily Checks
• 90 Day Contractor Compliance Plan for Safety Managers in Construction
• Contractor Compliance Checklist: 3 Point Pre Mobilization Gate