You usually need an audit log on the day something goes wrong. It must already be running.
What to record
Who changed what, in which module and when. Propto’s audit log filters by module, user and date.
Use it routinely
Review role and policy changes weekly. Small drifts become big risks.
Protect it
Limit who can see the log and never edit it.
Why an audit log matters
As more people gain access to a CRM holding sensitive buyer, financial and partner information, the question of who changed what, and when, becomes important for both security and trust. An audit log provides a reliable answer, recording administrative actions across the system.
Without it, resolving disputes or investigating mistakes relies on memory and guesswork, which rarely satisfies anyone involved.
What to record
A useful audit log captures the user, the action taken, the module or record affected, the timestamp and, where relevant, the before and after values of significant changes, such as a price update or a role change.
Cover high-impact areas specifically: bookings, payments, user roles, pricing and sensitive document access, even if lower-impact browsing activity is not logged in the same detail.
Use it routinely
Do not treat the audit log as something consulted only during a crisis. Review it periodically as part of normal governance, such as checking recent role changes or price updates during a monthly operations review.
Routine use familiarises the team with what normal activity looks like, making unusual entries easier to notice.
Protect it
An audit log that can be edited or deleted by the same people whose actions it records provides little real protection. Restrict modification rights tightly, ideally so that even administrators cannot alter historical entries.
Back up audit data as part of your overall data protection practices.
Using the log for disputes
When a buyer or partner disputes a change, such as a price or a commission calculation, the audit log provides an objective record to resolve the disagreement quickly and fairly, rather than relying on conflicting recollections.
Reference specific log entries when explaining decisions, which builds confidence that your process is transparent and consistent.
Using the log for security
Unusual patterns, such as a user accessing many records outside their normal role or a spike in changes from one account, can indicate a security issue worth investigating. Regular review helps catch problems early rather than after significant damage.
Combine audit log review with your broader access control and permissions practices for stronger overall governance.
Why it matters for the business
An audit log supports accountability, resolves disputes efficiently, deters misuse and demonstrates good governance to banks, investors and auditors who may review your systems and controls.
For a growing company, this kind of discipline becomes increasingly important as more people gain system access and more money flows through recorded transactions.
Getting the team involved
Management and IT review the audit log periodically, and anyone resolving a dispute or investigating a concern should know how to search it effectively. Keep a simple guide on how to use the log for common questions.
Train new administrators on both the existence and the importance of the audit log early in their role.
A worked example
A buyer disputes a price shown on their cost sheet, claiming it differs from what they were originally quoted. The audit log shows exactly when the price was updated, by whom and under what approved bulk price change, settling the question within minutes rather than becoming a prolonged disagreement.
Separately, a monthly governance review notices an unusual number of role changes made by one administrator account in a single day, prompting a quick, reassuring conversation that confirms a legitimate bulk update during a team reorganisation.
Common mistakes
Common mistakes include logging too little detail to be useful, allowing the log itself to be edited, never reviewing it until a crisis forces the issue and failing to train staff on how to search it effectively.
Another mistake is assuming an audit log alone prevents misuse; it records and deters, but genuine prevention also depends on well-designed roles and permissions.
Questions teams often ask
How long should audit logs be retained? Align retention with your data policies and any applicable legal requirements, keeping enough history for realistic dispute and audit needs.
Who should have access to the audit log? Limit it to management, IT and designated governance roles, since the log itself may reveal sensitive activity.
An audit log checklist
Key actions logged with user, action, record and timestamp, including before and after values for significant changes. High-impact areas covered specifically.
Log reviewed routinely, not only during crises. Modification rights tightly restricted. Used actively for dispute resolution and security monitoring.
In practice
Confirm which actions your system currently logs, extend coverage to any high-impact gaps such as pricing or role changes, and build a simple monthly review into your governance routine.
Train a few key staff on how to search and interpret the log effectively.
In short
Record key administrative actions with enough detail to be useful, protect the log from tampering, review it routinely rather than only in a crisis and use it actively to resolve disputes and monitor for unusual activity.
What does the audit log cover?
Admin actions across bookings, projects, users, payouts, attendance and settings.