Audit Trail (in QuickBooks)

Why the audit trail matters

The audit trail matters because it is the one part of the books that answers who and when, not just what — and that accountability is what makes a set of books trustworthy rather than merely tidy. A clean balance sheet tells you the numbers add up; the audit trail tells you the numbers were arrived at honestly, by known hands, without quiet edits after the fact.

Two audiences care about that. The first is anyone relying on your numbers in good faith — a lender, an investor, a new accountant at year-end, the IRS if it ever looks. Sound recordkeeping is not just having figures but being able to show how they came to be, and the audit trail is the layer that supplies that history. The second audience is you. Most small-business loss is not dramatic theft; it is small, repeated adjustments that a healthy audit trail makes visible — a voided invoice quietly re-issued, a vendor payment redirected, a reconciled transaction changed weeks later. Without the trail, those edits vanish into a balance that still, deceptively, ties out.

This is why the audit trail sits at the center of any conversation about security and internal control in QuickBooks. It does not prevent a bad change — but it removes the assumption that a change can be made invisibly, and that assumption is what most casual manipulation depends on.

What the QuickBooks audit log records

The QuickBooks audit log records far more than transactions: it captures the full stream of account activity — every transaction created, edited, or deleted, along with user sign-ins, changes to company settings, and edits to customers, vendors, employees, and payroll. Each entry names the user, the date and time, and what changed.

In practice, that means the log answers questions a plain register never could. When an invoice total changes, the log holds both the old figure and the new one. When a transaction disappears, the log records the deletion, who did it, and when — which is how deleted invoices and payments are recovered rather than lost. When someone signs in, changes the closing date, or edits a customer's details, that too is written down. Intuit's official help, Use the audit log in QuickBooks Online, describes this scope and confirms that the log tracks not only financial transactions but account activity generally.

Every entry a bookkeeper posts flows through here. A journal entry made to fix a mis-posting, an edit to a bill, a re-categorized expense — each becomes a logged event, so the record of corrections is itself preserved. That completeness is deliberate: the value of an audit trail collapses the moment some changes escape it.

Why the audit log can't be turned off

In QuickBooks Online the audit log cannot be turned off — not by a user, not by the primary admin, not at all. Intuit states plainly, for audit and security reasons, that the log is always on; it is a permanent feature of the file, not a setting you opt into.

That design decision is the whole point of the control. A log you could disable before making a sensitive change, then re-enable afterward, would record only the changes people wanted recorded — which is to say, it would record nothing that mattered. By making the log mandatory and continuous, QuickBooks Online removes that escape hatch: the only way to keep a change out of the trail is not to make the change. To read the log, open the Settings (gear) menu and choose Audit log; the filter panel lets you narrow by user, by date, or by event type. Access requires admin rights, so who can read the trail is itself controlled, even though no one can stop it from being written.

QuickBooks Desktop treats this differently in form but not in spirit. There the equivalent is the Audit Trail report, found under Reports, then Accountant & Taxes, then Audit Trail, which lists additions, changes, and deletions across the company file. On any single transaction in QuickBooks Online, the More menu also exposes an Audit history for just that record — a focused view of one invoice or bill's entire edit history. Menu paths shift slightly between releases; Intuit's official QuickBooks support documents the current locations.

Audit log

How a bookkeeper uses the audit trail

A bookkeeper uses the audit trail to answer specific questions about the books that no other report can settle: what happened to a missing transaction, who changed a figure that used to be right, and whether anything was altered after a period was closed. It is an investigative tool, reached for the moment a number stops making sense.

The most common use is recovery. When a customer swears an invoice existed and it is gone, the log shows the deletion — the invoice number, the amount, the user, the time — so the record can be re-entered accurately instead of guessed at. The second common use is explaining a moved balance: a reconciled account that no longer reconciles often traces to a transaction edited or deleted after the fact, and the log names exactly which one and by whom. In a cleanup, this is routine. Before touching anything, a specialist reads the trail to understand how the file got into its current state — which entries were reworked, whether the closing date was overridden, whether the same login was used for everything. That reading shapes the whole engagement; it is part of why our methodology starts by understanding the file's history rather than immediately overwriting it.

The trail is also how a bookkeeper protects the good work after it is done. Once a period is reconciled and closed, the log becomes the evidence that it stayed closed — that no one reached back and quietly changed a filed month. Reviewing the log on a schedule, rather than only in a crisis, turns it from a forensic last resort into an ordinary control.

The limits of the audit trail

The audit trail has real limits, and treating it as a complete safeguard is a mistake: it records changes but does not prevent them, it cannot judge whether a change was right, and it only ever sees what happens inside QuickBooks. Knowing where it stops is as important as knowing what it captures.

Several limits deserve naming directly:

• It is detective, not preventive. The log records a fraudulent or mistaken change after it happens; it does nothing to stop the change in the first place. Prevention comes from permissions and separation of duties, not from the log.
• It cannot tell right from wrong. The trail shows that an amount went from $1,200 to $2,100. It cannot tell you whether that was a legitimate correction or theft. Interpretation is human work, and it requires someone actually reading the log.
• A shared login blinds it. The log's greatest strength is naming who — and that collapses the instant everyone signs in as the same admin user. Separate logins for separate people are what make the "who" meaningful.
• It stops at the edge of the file. Cash that was never entered, a source document that was altered on paper, income that never reached the books — none of it appears, because the log can only record activity that touches QuickBooks.
• The online window is finite. Per Intuit's documentation, QuickBooks Online keeps audit-log events available for two years. That is ample for most reviews, but it is not forever, so audit-ready practice does not assume the log will always be there to consult.

None of these limits make the audit trail less valuable — they define what it must be paired with. A log is powerful precisely to the degree that real controls surround it: distinct user logins, restricted permissions, monthly reconciliation, and a person independent of the day-to-day bookkeeping who actually reads it.

The audit trail and audit-ready books

The audit trail is the backbone of audit-ready books because it is the evidence layer: it is what lets you prove, not just assert, that the numbers are clean, closed, and unedited since. Books that reconcile are a good start; books whose history you can show on demand are the finished state.

Getting there is less about the log itself — which runs automatically — than about the discipline around it: reconciling every account monthly so the trail records a settled state, closing periods with a closing date so later edits stand out, giving each person their own login so the log's "who" stays honest, and reviewing the trail rather than trusting it unread. That discipline is exactly what an engagement to build audit-ready books puts in place, and it is the standard our methodology works toward on every file. If you are not sure what your own audit trail would reveal — whether transactions were edited after close, or whether one shared login hides who did what — a free QuickBooks review reads the file and tells you plainly before any work begins.

Where this shows up