Showing who changed a record and when
How a firm shows who changed a governed record in Achekam, when and with what result, checks the log for an unbroken chain, and knows what it covers.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Sooner or later someone asks the question every firm dreads: who changed this, and when? It may come from a practice reviewer, from a client disputing what was agreed, from a partner investigating an error, or in the worst case from a lawyer. "We think it was probably the manager, some time in March" is not an answer that survives any of those audiences.
The answer has to come from a record that the firm did not write after the event, and that it can show has not been tampered with. In Achekam, that record is the Record Governance log. This article explains what it covers, how to read it, how to check it is intact, who may see it, and where its coverage stops.
What a governed record is
Achekam places certain records under record governance. These are the records the firm must be able to account for over time: they are kept for a retention period, can be placed under legal hold, and are disposed of only through a controlled process. Achekam disposes of a governed record only after its retention period has ended and no legal hold applies, with three different people requesting, reviewing and approving, and the disposal certificate keeps proof of the disposal but not the content.
The log is the other half of that discipline. Retention decides how long a record lives; the log records what happened to it while it did. Legal holds and disposal are covered in legal holds and disposal.
Reading the log
Record Governance, under QUALITY & GOVERNANCE, keeps a log of changes to governed records showing who did what, when and with what result. The log can be filtered, so a reviewer can narrow it to one record, one person or one period.
Each entry answers four questions:
| Question | Why it matters |
|---|---|
| Who? | Accountability rests with a named person, not "the system" |
| Did what? | The action taken, so a change can be distinguished from a view or an approval |
| When? | Sequence matters when two people acted on the same record |
| With what result? | The outcome of the action, not just the fact that it was taken |
The last column is often overlooked. Where an entry shows an action that did not succeed, read it as carefully as one that did: it may tell a reviewer that a control worked, and also that someone tried.
When answering a question from the log, export or screenshot only what is needed, and note the filter used, so the answer can be reproduced later by someone else.
Checking that the chain is unbroken
A log is only persuasive if the firm can show it has not been edited after the fact. Achekam's log can be checked for an unbroken chain, a check designed to show whether the sequence of entries is intact.
Run that check as part of any formal review, and before relying on the log in a dispute. Record the date and the result of each check. A firm that checks the chain regularly, and can show it did, is in a much stronger position than one that runs the check for the first time when it is challenged.
If a check ever reports a break, treat it as an incident: record when it was found and by whom, preserve what you can, and escalate to the partner responsible for quality.
Who may view it
Viewing the log needs the AUDIT_LOG_VIEW permission. A firm can allow or deny what each role may do and check why a particular member may or may not act, and a firm administrator gives each colleague a role when inviting them.
Decide deliberately who holds this permission. The log reveals a great deal about how people work, and it should be available to those responsible for quality and governance, typically the partner responsible for quality, the managing partner and an administrator, rather than to everyone. Review the list whenever someone changes role. The broader permission model is set out in roles and permissions.
What the log does not cover
The Record Governance log covers records under record governance, not every screen in Achekam. It is not a general recording of everything every user does.
Other parts of Achekam keep their own histories. The firm's quality registers, such as professional judgements, quality incidents, complaints and inspection progress, are kept on the server with every version and who changed it. Restrictions on client access record who restricted or lifted a restriction and when. When a question concerns something outside governed records, look in the history that belongs to that area rather than expecting the governance log to hold it.
Retention periods themselves are set by law and by the firm's own policy, and they differ by country and by type of record. For South African firms, SARS's page on record keeping sets out who must keep records under the Tax Administration Act, which records and documents to keep, and the five-year retention periods. Professional and company-law requirements may be longer; the firm's retention policy should reconcile them.
A routine that makes the log useful
- Name who holds AUDIT_LOG_VIEW and review the list quarterly.
- Run the chain check on a fixed schedule and record each result.
- Practise answering one realistic question from the log, such as who last changed a particular governed record, before you need to.
- Write down, for staff, which records are governed and where other histories are kept.
Pick one governed record this week and trace its history in the log from start to finish. If anything is unclear, it is far better to find out now than when someone else is asking.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
