Doc · Concept

Audit trail (in QuickBooks)

The audit trail — called the Audit Log in QuickBooks Online — is the automatic, permanent record of who did what in your books and when: every transaction created, edited, or deleted, plus sign-ins and settings changes, each one stamped with the user who made it and the exact time. It runs whether or not anyone is watching.

Call (850) 842-6767

Last reviewed October 2026

The Desktop audit trail, and Online's audit log

QuickBooks Desktop: Reports → Accountant & Taxes → Audit Trail, filtered by date entered or edited, shows each transaction's history with the user who made each change. QuickBooks Online: a transaction's Audit history (More → Audit history), and Settings → Audit log for every change across the company; Intuit says audit-log events are available for two years (Intuit, checked October 2026). The Desktop audit trail doesn't move to Online in a conversion, so keep the Desktop file if you migrate.

Why the audit trail matters

The audit trail matters because it is the one part of the books that answers who and when, not just what — and that accountability is what makes a set of books trustworthy rather than merely tidy.

A clean balance sheet tells you the numbers add up; the trail tells you the numbers were arrived at honestly, by known hands, without quiet edits after the fact.

Two audiences care about that. The first is anyone relying on your numbers in good faith — a lender, an investor, a new accountant at year-end, the IRS if it ever looks. Sound recordkeeping is not just having figures but being able to show how they came to be, and the audit trail is the layer that supplies that history. The second audience is you. Most small-business loss is not dramatic theft; it is small, repeated adjustments that a healthy audit trail makes visible — a voided invoice quietly re-issued, a vendor payment redirected, a reconciled transaction changed weeks later. Without the trail, those edits vanish into a balance that still, deceptively, ties out.

This is why the trail sits at the center of any conversation about security and internal control in QuickBooks. It does not prevent a bad change — but it removes the assumption that a change can be made invisibly, and that assumption is what most casual manipulation depends on.

What the QuickBooks audit log records

The QuickBooks audit log records far more than transactions: it captures the full stream of account activity — every transaction created, edited, or deleted, along with user sign-ins, changes to company settings, and edits to customers, vendors, employees, and payroll.

Each entry names the user, the date and time, and what changed.

In practice, that means the log answers questions a plain register never could. When an invoice total changes, the log holds both the old figure and the new one. When a transaction disappears, the log records the deletion, who did it, and when — which is how deleted invoices and payments are recovered rather than lost. When someone signs in, changes the closing date, or edits a customer's details, that too is written down. Intuit's official help, Use the audit log in QuickBooks Online, describes this scope and confirms that the log tracks not only financial transactions but account activity generally.

Every entry a bookkeeper posts flows through here. A journal entry made to fix a mis-posting, an edit to a bill, a re-categorized expense — each becomes a logged event, so the record of corrections is itself preserved. That completeness is deliberate: the record's value collapses the moment some changes escape it.

Why the audit log can't be turned off

Audit log

Read this as text

An audit-log entry for a single change. User J. Rivera edited Invoice 1042 on July 2 at 2:14 PM, changing the total from $1,200.00 to $2,100.00. The log captures who made the change, when it happened, and the value before and after. An illustrative example, not measured data.

A single edit as the audit log records it — the user, the timestamp, and the amount before and after — so every change carries its own accountability. An illustrative example, not measured data.

In QuickBooks Online the audit log cannot be turned off — not by a user, not by the primary admin, not at all.

Intuit states plainly, for audit and security reasons, that the log is always on; it is a permanent feature of the file, not a setting you opt into.

That design decision is the whole point of the control. A log you could disable before making a sensitive change, then re-enable afterward, would record only the changes people wanted recorded — which is to say, it would record nothing that mattered. By making the log mandatory and continuous, QuickBooks Online removes that escape hatch: the only way to keep a change out of the trail is not to make the change. To read the log, open the Settings (gear) menu and choose Audit log; the filter panel lets you narrow by user, by date, or by event type. Access requires admin rights, so who can read the trail is itself controlled, even though no one can stop it from being written.

QuickBooks Desktop treats this differently in form but not in spirit. There the equivalent is the Audit Trail report, found under Reports, then Accountant & Taxes, then Audit Trail, which lists additions, changes, and deletions across the company file. On any single transaction in QuickBooks Online, the More menu also exposes an Audit history for just that record — a focused view of one invoice or bill's entire edit history. Menu paths shift slightly between releases; Intuit's official QuickBooks support documents the current locations.

How a bookkeeper uses the audit trail

A bookkeeper uses the audit trail to answer specific questions about the books that no other report can settle: what happened to a missing transaction, who changed a figure that used to be right, and whether anything was altered after a period was closed.

It is an investigative tool, reached for the moment a number stops making sense.

The most common use is recovery. When a customer swears an invoice existed and it is gone, the log shows the deletion — the invoice number, the amount, the user, the time — so the record can be re-entered accurately instead of guessed at. The second common use is explaining a moved balance: a reconciled account that no longer reconciles often traces to a transaction edited or deleted after the fact, and the log names exactly which one and by whom. In a cleanup, this is routine. Before touching anything, a specialist reads the trail to understand how the file got into its current state — which entries were reworked, whether the closing date was overridden, whether the same login was used for everything. That reading shapes the whole engagement; it is part of why our methodology starts by understanding the file's history rather than immediately overwriting it.

The trail is also how a bookkeeper protects the good work after it is done. Once a period is reconciled and closed, the log becomes the evidence that it stayed closed — that no one reached back and quietly changed a filed month. Reviewing the log on a schedule, rather than only in a crisis, turns it from a forensic last resort into an ordinary control.

The limits of the audit trail

The audit trail has real limits, and treating it as a complete safeguard is a mistake: it records changes but does not prevent them, it cannot judge whether a change was right, and it only ever sees what happens inside QuickBooks.

Knowing where it stops is as important as knowing what it captures.

Several limits deserve naming directly:

It is detective, not preventive. The log records a fraudulent or mistaken change after it happens; it does nothing to stop the change in the first place. Prevention comes from permissions and separation of duties, not from the log.
It cannot tell right from wrong. The trail shows that an amount went from $1,200 to $2,100. It cannot tell you whether that was a legitimate correction or theft. Interpretation is human work, and it requires someone actually reading the log.
A shared login blinds it. The log's greatest strength is naming who — and that collapses the instant everyone signs in as the same admin user. Separate logins for separate people are what make the "who" meaningful.
It stops at the edge of the file. Cash that was never entered, a source document that was altered on paper, income that never reached the books — none of it appears, because the log can only record activity that touches QuickBooks.
The online window is finite. Per Intuit's documentation, QuickBooks Online keeps audit-log events available for two years. That is ample for most reviews, but it is not forever, so audit-ready practice does not assume the log will always be there to consult.

None of these limits make the trail less valuable — they define what it must be paired with. A log is powerful precisely to the degree that real controls surround it: distinct user logins, restricted permissions, monthly reconciliation, and a person independent of the day-to-day bookkeeping who actually reads it.

The audit trail and audit-ready books

The audit trail is the backbone of audit-ready books because it is the evidence layer: it is what lets you prove, not just assert, that the numbers are clean, closed, and unedited since.

Books that reconcile are a good start; books whose history you can show on demand are the finished state.

Getting there is less about the log itself — which runs automatically — than about the discipline around it: reconciling every account monthly so the trail records a settled state, closing periods with a closing date so later edits stand out, giving each person their own login so the log's "who" stays honest, and reviewing the trail rather than trusting it unread. That discipline is exactly what an engagement to build audit-ready books puts in place, and it is the standard our methodology works toward on every file. If you are not sure what your own audit trail would reveal — whether transactions were edited after close, or whether one shared login hides who did what — a free QuickBooks review reads the file and tells you plainly before any work begins.

Where this shows up

In practice, the trail surfaces here in three places: the audit-ready standard it evidences, the controls that make its "who" meaningful, and the file review that reads it first.

Questions about the audit trail

Can you turn off the audit log in QuickBooks Online?

No. QuickBooks Online records the audit log automatically and, for audit and security reasons, does not let anyone switch it off — not even the primary admin. That is by design: a log you could disable before making a change would be worthless as a control. Intuit's own help states the audit log cannot be turned off.

Where is the audit log in QuickBooks?

In QuickBooks Online, open the Settings (gear) menu and select Audit log; you need admin access to see it. In QuickBooks Desktop the equivalent is the Audit Trail report, under Reports, then Accountant & Taxes, then Audit Trail. On any single transaction in QuickBooks Online, the More menu also shows an Audit history of just that record's changes.

How far back does the QuickBooks audit log go?

Per Intuit's documentation, QuickBooks Online keeps audit-log events available for two years. The QuickBooks Desktop Audit Trail report reaches back over the transactions held in the company file itself. Because the online window is finite, an audit-ready practice reviews and, where needed, preserves the log rather than assuming it will be there indefinitely.

Does the audit log show who deleted a transaction?

Yes. A deletion is an event like any other — the log records that the transaction was deleted, which user did it, and when. This is exactly how a bookkeeper recovers the details of a deleted invoice or payment: you find the deletion in the log, read what the record used to contain, and re-enter it correctly.

Is the audit trail enough to prevent fraud on its own?

No. The audit trail is a detective control, not a preventive one — it records what happened but does not stop it, and it cannot tell you whether a change was legitimate or not. It is powerful when paired with real controls: separate user logins, restricted permissions, monthly reconciliation, and someone independent actually reading the log.

Audit trail (in QuickBooks)

More on this topic