The Log Nobody Can Shorten Alone
The person most likely to want an audit trail shortened is the one it describes. An audit retention lock keeps every log row for a period you choose, from one year to ten, lets anyone lengthen it at once, and makes shortening or lifting it a request that waits a week and needs somebody else to confirm.
A donor’s auditor arrives at a Kenyan NGO two years after a grant closed and asks to see who approved a set of fuel payments in the second quarter. The audit log would have answered in a minute. It had been trimmed to twelve months the previous year, by an administrator tidying up storage, with a retention policy that was entirely within his rights to set. Nobody did anything wrong, and the answer is gone.
A retention policy is a good thing. Personal data should not be kept forever, and a policy that deletes what is no longer needed is what a data protection officer asks for. The trouble is that the same setting which trims old customer records can trim the audit log, and the audit log is the one record whose value grows with age. It is also the one record a dishonest administrator has the strongest reason to shorten, which is why we argued that an audit trail your admin can delete is barely an audit trail at all.
Locked for a period you choose
Someone who manages your security settings locks audit log retention for between 365 and 3,650 days. From then on, no retention policy can purge or anonymise an audit row younger than that: where a policy and the lock disagree, the longer of the two wins. The lock itself can be lengthened at any time, in place, and that is the only direction it moves without a wait. Seven years, if that is what your regulator asks of a SACCO, or the length of a donor’s grant plus its audit window, is one setting.
| Change to the lock | What happens |
|---|---|
| Lock it, or make it longer | Applies at once |
| Make it shorter | Refused; ask for a release instead |
| Lift it | A request, a seven-day wait, and a different person to confirm |
| Delete the whole organization | Refused while the lock is on |
Why a week, and why somebody else
-
Someone asks
A release request is recorded in the audit log with who asked and when. The lock stays fully in force.
-
Seven days pass
Long enough for anyone who reads the audit log, or who notices the request on the security settings page, to ask why.
-
A different person confirms
The requester cannot confirm their own request. Someone else who manages security settings has to.
-
Or it is withdrawn
A request can be cancelled at any point in the week, and the cancellation is recorded too.
The wait does the work a second signature alone cannot. A compromised administrator account can usually get a colleague to click a button within an hour. A request that has to sit in plain view for a week, in a log that cannot be edited, is much harder to slip past. The second person then turns a long wait into a deliberate decision rather than an automatic one.
Every other record is kept for what it says. The audit log is kept for who it might one day describe.
One consequence is deliberate and worth knowing before you switch it on. While the lock is on, a request to delete the whole organization will not complete: the purge is refused and recorded, because the audit rows cannot outlive the workspace they belong to. Lifting the lock comes first, with its week and its second person. The lock also counts as one of the eight recommended controls in the security posture score, so switching it on is visible on the score the next morning.
The short version
If anyone outside your organization may one day ask who approved what, lock your audit log for at least as long as they might ask. Lengthening is instant, shortening needs a week and a second person, and nothing, including a deletion of the whole organization, gets round it in the meantime.
What AWRA OpsHub does today
- An audit retention lock of 365 to 3,650 days, set by anyone who manages security settings.
- Retention policies held below the lock, so no audit row younger than the locked period is purged or anonymised.
- Lengthen at once, never shorten in place.
- Release by request, a seven-day wait and a different person to confirm, with cancellation at any point.
- Every lock, request, cancellation and release in the audit log.
- Organization deletion refused while the lock is on.
- The lock counted in the security posture score as one of eight recommended controls.
More we can add to your workspace
- An email to every administrator the moment a release is requested, so the week starts with everyone knowing.
- A release that needs two confirmers, for organizations that want three people involved.
- The same lock on other records, such as approved documents and posted journals.
Where we point you to a specialist
- We will not tell you how long your records must be kept. That depends on your regulator, your donors and your auditor, and is theirs to state.
The release notice is the one most organizations want first, and it uses the bell and email copy every workspace notification already has.
A lock that fits your audit obligations
The lock, the one-way lengthening, the week-long release and the deletion guard are in place. These extensions come up most often.
A release notice to every admin
The request announced by email and in the bell on the day it is made.
Two confirmers
A release that needs two people other than the requester.
Locks on more records
The same rule on approved documents or posted journals, for the records an auditor samples.
Three questions about your own audit log
How far back does your audit log go today?
What you will probably hear
Since we started, probably.
How to read it
Probably is the word to check. A retention policy may already be trimming it.
Who could shorten it, and would anyone notice?
What you will probably hear
Any administrator, and no.
How to read it
That is the control to fix before the auditor asks.
How long after a grant or financial year could someone ask?
What you will probably hear
A few years.
How to read it
That figure, not your storage bill, is the right lock period.
See audit trail integrity
A hash-chained audit log with no delete button, the receipts a retention purge leaves behind, and the retention lock that holds it.
Explore audit trail integrityFrequently asked questions
What is an audit retention lock?
A setting that keeps every audit log row for a period you choose, between one and ten years. While it is on, no retention policy can purge or anonymise an audit row younger than that period.
Can the lock be shortened?
Not in place. It can be lengthened at any time. To shorten or lift it, someone requests a release, which waits seven days and then needs a different person who manages security settings to confirm it.
Can the person who asked for the release confirm it?
No. A different person has to confirm it, after the seven-day wait. The requester can cancel the request at any point.
Can we delete our organization while the lock is on?
The deletion will not complete while the lock is on. Lift the lock first, with its seven-day wait and second confirmation.
Is changing the lock recorded?
Yes. Locking, lengthening, requesting, cancelling and confirming a release are each written to the audit log.
