The audit log records who viewed, changed or exported what, and when. Entries can't be edited or deleted by anyone. This tutorial shows how to search the log, look at one person's activity and produce a signed export for an investigation or audit.
Before you begin
- The View audit log permission (compliance.audit.view). The signed export needs compliance.audit.export.
Open and filter the log
- Go to Quality → Audit log.
- Choose the window in the table toolbar: Today, Last 7 days (the default) or Last 30 days.
- Use the filters User, Action and Record type, or search by name, action, event, reason or IP address.
- Read each row: When, User, Action (for example Viewed, Created, Updated, Deleted, Exported, Permission changed), Record type, Detail and IP address.
Audit log with the append-only banner, four tiles and the event table filtered to Action: Exported
Read the summary tiles
- Events today shows today’s events and the total in the window.
- Changes counts records created, updated, deleted or approved.
- Exports counts exports and prints. Every export is logged.
- Permission changes counts permission changes and break-glass access, with sign-ins underneath.
Look at one person’s activity
- Open the log from a person’s profile or the users list, or choose the person in the User filter.
- When opened for one person, a line shows Showing … events by their name.
- Select Show everyone to go back to the full log.
Produce a signed export
- Select Signed export in the table toolbar.
- Set From and To (the end date can’t be later than today).
- Choose the Format: CSV, PDF (signed) or JSON.
- Select Export. You may be asked to confirm it is you.
- Wait for Signed export ready. The file opens in a new tab. This export is itself logged.
The table’s own export button exports only the rows on screen. Use Signed export when you need a complete, tamper-evident record.
Tips
- Records are retained for 7 years, the period NDIS providers must keep them, and stored in Australia.
- Check Permission changes after any change to roles, and look for break-glass events when restricted records were opened.
If something goes wrong
Showing the most recent … events in this window
The window holds more events than the screen can show. Narrow the window or the filters, or use Signed export for everything.
The start date must be before the end date.
Change From or To so the range runs forwards.
Signed export isn’t in the toolbar
You need the audit export permission. Ask an administrator.