An audit trail is the immutable record of what happened, when, and at whose hand. In a measurement context it covers more than most organizations assume, and the part they usually have is the least important part.
The access trail records who logged in, what they viewed, what they exported. Most platforms provide this and most organizations stop here.
The measurement trail records what happened to the numbers. Which definition version was in effect on a given date. When a definition changed and who approved it. When a value was recomputed and why. What the original value was before a correction. Who entered a manual figure, when, and what evidence they attached. Which ingestion run produced which records.
The access trail satisfies a general IT control requirement. The measurement trail is what answers the questions an auditor actually asks about a reported figure.
Time. The questions arrive years after the events, often after the tools have been replaced and the people have moved on.
Deletion. An audit trail that can be edited by the people it records is not an audit trail. Append-only, or it does not count.
The departure of the people involved. If reconstructing what happened requires asking someone, the trail is incomplete.
Longer than you expect. Regulatory examination cycles run to several years, and a supervisor asking about a period will expect the supporting record to still exist.
Retention should be set against the longest applicable examination window rather than against storage cost, which for structured measurement records is small.
They can prove who accessed the reporting system. They cannot prove how a figure reported in a specific meeting was calculated, whether it has changed since, or who approved the change.
That gap is invisible until the first serious challenge, at which point it is expensive. See reproducibility.
From the blog