Audit trail

Operator definition

An audit trail answers what changed, when, by whom or what, and from which prior state.

In planning, that record may cover source-data corrections, forecast approvals, policy changes, scenario publication, manual overrides, engine upgrades, recommendation approval, order release, allocation, reservation, promise, cancellation, and reallocation.

A useful audit trail does not merely prove that someone clicked a button. It preserves enough context to understand the planning significance of the event and to link it to the run, evidence, demand, supply, and commitment affected.

Why it matters

Plans change for legitimate reasons. The trust problem begins when those reasons disappear.

An audit trail supports accountability, incident review, dispute resolution, regulated records, security investigations, implementation validation, and learning from overrides. It also protects planners. When a decision is later challenged, the record can show the evidence available at the time, the alternatives considered, the authority that accepted the tradeoff, and what changed afterward.

The planning physics

A minimal event record includes:

• event_id
• actor or service identity
• event timestamp and effective timestamp
• object and prior version
• before value / state and after value / state
• reason and evidence reference
• source plan run / scenario
• approval or authority
• supersession / rollback link

Planning needs both transaction history and decision context. A secure time-stamped log can show that a value changed. A planning evidence graph can show why that change mattered to the recommendation. A replay package can reproduce or forensically explain the calculation. These capabilities overlap, but they are not synonyms.

Simple example — evidence timeline

A planner overrides a supplier lead time from 60 to 45 days and the engine moves a release date two weeks later.

A weak log says:

Lead time changed: 60 -> 45 by User 214.

A useful planning audit trail says:

Object: Supplier-item-lane lead time
Before: 60 calendar days
After: 45 calendar days
Evidence: supplier contract amendment dated June 12
Scope: Item family X, Site B, effective July 1-December 31
Authority: Procurement lead approved
Run affected: PR-2026-06-20-04
Plan effect: 3 releases moved; 1 expedite removed
Review date: September 30

The second record supports learning and challenge. It also makes the override visible as accepted judgment rather than system-generated truth.

What goes wrong without it

• Users cannot distinguish data correction from policy change.
• Manual overrides appear to be engine output.
• A commitment is cancelled without a durable record of the displaced demand.
• A model update changes plans but no one can identify the version boundary.
• Incident review relies on screenshots and memory.
• "Explainability" becomes a generated story assembled after the fact.
• Records exist but are alterable, incomplete, or disconnected from the planning object.

How it shows up in high-consequence supply chains

Controlled-substance supply chains make the requirement concrete: inventory, ordering, distribution, shipping, and storage records must be inspectable because diversion risk is part of the operating context. The audit trail is not only a compliance file. It is the evidence that the right substance, quantity, location, carrier, and authority moved through the chain.

Other sectors impose similar record discipline for different reasons. A 503B outsourcing facility may need batch production, control, quality review, and distribution records so a compounded drug can be traced by lot and consignee. Aviation life-limited parts need records or markings that preserve part number, serial number, and current life status when the part is removed or transferred.

The exact legal requirement varies. The planning principle travels more broadly: consequential decisions should preserve what the organization knew, what it changed, who authorized the change, and which obligation resulted.

Common confusion

An audit trail is not the same as a natural-language explanation. The explanation may summarize the trail, but the trail is the evidence.

It is also not the same as exact replay. A system can keep a perfect history of output changes without retaining enough input and engine context to recompute the result. Conversely, a reproducible calculation still needs an audit trail for publication and commitment transitions.