Security & Compliance - Audit Logging is where ERP discipline either begins or breaks.
Immutable Audit Log and Compliance Trail looks operational from far away. In a real finance team, it is a chain of assertions: the right actor started the work, the required records existed, the control policy was applied, the state change was preserved, and the outcome can be explained later without rebuilding the transaction from emails and spreadsheets.
The expected business outcome is specific: External auditors complete SOC 2 Type II evidence collection without manual sampling; forensic investigation traces any transaction to its originating user in ≤5 min.
The control flow a finance team actually needs.
Step 1
Audit Event Written In The Same...
Step 2
Append-Only Storage - No Update Or...
Step 3
Cryptographic Chaining Verifiable By...
Step 4
Audit Log Query API Pagination,...
Step 5
Retention Configurable Per Compliance...
The ERP surface involved.
Module
Security & Compliance - Audit Logging
Actors
All System Users, Auditor, Compliance Officer, Security Officer
Tier
Tier 2
Finance area
Platform, Integration, Security, Administration & Analytics
Region lens
US and UK finance teams
Publication date
June 20, 2026
Audit event written in the same transaction as the state change (zero events dropped); append-only storage - no update or delete API on audit events; cryptographic chaining verifiable by auditor CLI command; audit log query API supports pagination, filtering by 6+ dimensions, and full-text search on resource_id; retention configurable per compliance policy (default 7 years); export to SIEM (Splunk, Datadog, AWS CloudWatch) via webhook push or pull API; audit log read access is a separate permission not bundled with admin; query performance ≤2 s for 1 M event result sets.
US and UK teams have different compliance hooks, but the same control problem.
US teams usually care about clean evidence for audit support, vendor records, payment controls, tax reporting, and management review. UK teams usually care about VAT-ready records, approval evidence, digital-record discipline, and traceable postings. The country-specific details differ, but the operating pattern is the same: the ERP needs controlled records, explicit ownership, defensible state changes, and evidence that survives beyond the person who completed the task.
The control matrix.
| Control area | Requirement | Acceptance proof |
|---|---|---|
| Control 1 | Audit event written in the same transaction as the state change (zero events dropped | Given a posted journal entry |
| Control 2 | append-only storage - no update or delete API on audit events | when the journal entry is created, then an audit event is written synchronously in the same transaction with actor, resource_id, before/after state hash, and request_id before the HTTP response is returned |
| Control 3 | cryptographic chaining verifiable by auditor CLI command | when an auditor queries the audit log by resource_id and date range, then all matching events are returned with cryptographic chain verifiable |
| Control 4 | audit log query API supports pagination, filtering by 6+ dimensions, and full-text search on resource_id | negative) when any code attempts to update or delete an audit event, then the operation returns 405 METHOD_NOT_ALLOWED. |
| Control 5 | retention configurable per compliance policy (default 7 years | External auditors complete SOC 2 Type II evidence collection without manual sampling; forensic investigation traces any transaction to its originating user in ≤5 min. |
| Control 6 | export to SIEM (Splunk, Datadog, AWS CloudWatch) via webhook push or pull API | External auditors complete SOC 2 Type II evidence collection without manual sampling; forensic investigation traces any transaction to its originating user in ≤5 min. |
Audit evidence is a chain, not a folder.
| Evidence layer | What should be preserved |
|---|---|
| Business event | Every state-changing operation (create, update, delete, approve, export, login, role change, config change) writes an audit event synchronously before the HTTP response is returned. Each event records: event_id, timestamp (UTC ISO 8601), actor (user_id, email, IP, user-agent), org_id, entity_id, action type, resource type, resource_id, before-state hash, after-state hash, and request_id. Audit events are written to an append-only store with cryptographic chaining (each event includes the hash of the prior event). Auditors query the log via a dedicated read-only UI with filters by actor, resource, date range, and action type. Export to CSV/JSONL available for external SIEM ingestion. |
| Control rules | Audit event written in the same transaction as the state change (zero events dropped); append-only storage - no update or delete API on audit events; cryptographic chaining verifiable by auditor CLI command; audit log query API supports pagination, filtering by 6+ dimensions, and full-text search on resource_id; retention configurable per compliance policy (default 7 years); export to SIEM (Splunk, Datadog, AWS CloudWatch) via webhook push or pull API; audit log read access is a separate permission not bundled with admin; query performance ≤2 s for 1 M event result sets. |
| Acceptance proof | Given a posted journal entry; when the journal entry is created, then an audit event is written synchronously in the same transaction with actor, resource_id, before/after state hash, and request_id before the HTTP response is returned; when an auditor queries the audit log by resource_id and date range, then all matching events are returned with cryptographic chain verifiable; (negative) when any code attempts to update or delete an audit event, then the operation returns 405 METHOD_NOT_ALLOWED. |
| Data record | |
| System event | |
| Lifecycle state | Audit events have no lifecycle state - immutable on creation; guard: no delete or update API; cryptographic chain verifiable by CLI command; retention configurable per compliance policy (default 7 years). |
The useful version of this workflow is not only fast. It is inspectable. A controller, auditor, or operator should be able to move from source event to system record to state transition to final business outcome without guessing.
Implementation contracts.
Reference data model
`audit_event` { event_id: string, timestamp: timestamp, actor_id: string, actor_ip: string, org_id: string, entity_id: string, action: string, resource_type: string, resource_id: string, before_hash: string, after_hash: string, request_id: string, prior_event_hash: string }; append-only - no UPDATE or DELETE; (reference, product may differ).API and events
`GET /v1/audit-events?actor_id=&resource_type=&resource_id=&from=&to=&page=&per_page=` -> 200 { events[], next_cursor }; `GET /v1/audit-events/{event_id}`; `POST /v1/audit-events/export` { format: enum(CSV,JSONL), filters } -> 202 { export_id }; `GET /v1/audit-events/verify-chain` -> 200 { valid: bool, first_broken_event_id }; emits via webhook push to SIEM on configurable filter; idempotent write via event_id.State transitions
Audit events have no lifecycle state - immutable on creation; guard: no delete or update API; cryptographic chain verifiable by CLI command; retention configurable per compliance policy (default 7 years).Common implementation traps.
Treating the workflow as data entry
If the ERP only stores the final record, the team loses the decision trail that explains how the record became valid.
Hiding exception logic
Exceptions need owners, reason codes, and time stamps. A vague pending state is not a control.
Posting without recovery design
Retries, duplicate submissions, and partial failures must be explicit so the system does not create inconsistent records.
Skipping evidence design
A workflow that cannot produce evidence on demand will eventually push finance teams back into manual screenshots and spreadsheets.
Where Rivane fits.
Rivane is built for finance workflows where automation must stay tied to source documents, approvals, state transitions, ledger impact, reporting, and audit evidence. Use this guide as a checklist for evaluating whether an ERP workflow is merely digitized or actually controlled.
References and source basis.
These sources provide the standards, regulatory, or government context around the flow. They are included so the guide is useful to finance operators, auditors, and implementation teams, not only buyers reading software copy.