Audit Trail

Typically the actor, the action, the object and the timestamp, and often the source address or device. In recruiting that means stage moves and rejections, edits to candidate fields, notes added or removed, scorecards submitted and changed, offers created and approved, permission and role changes, bulk operations, record merges and deletions, and exports of candidate data. Better systems distinguish between a user action and one performed by an automation or an integration acting on somebody's behalf, which matters when you are trying to understand why a candidate moved stage at two in the morning. What is captured varies by product, so treat the list as a question to ask rather than an assumption. Raise export and delete events specifically when comparing ATS features, because those matter most when something goes wrong and some systems log them least thoroughly.

Because memory is contested and logs are not. When a rejected applicant questions how a decision was reached, or an internal complaint alleges a candidate was moved for the wrong reasons, the useful evidence is a dated sequence showing who did what. A trail can establish that a scorecard was submitted before the debrief rather than written afterwards to justify an outcome, that a candidate was rejected at the stage the team says, or that a field was edited after a decision was taken. It protects people too, since a recruiter accused of an action they did not take has a record showing which account performed it. All of this works only if the log is genuinely append-only and retained long enough to still exist when the question arises, which is frequently much later than the hiring itself.

They are the evidence layer underneath most controls. Access reviews rely on a record of permission grants. Data protection requests are easier to answer when you can show when a record was accessed, exported or deleted. Segregation of duties, such as requiring approval from someone other than the requester, is only enforceable if the log shows who approved what. Security investigations start with the trail. Specific obligations differ substantially, because retention periods, what must be logged, who may see it and how long records of hiring decisions must be kept vary by country, state, sector and sometimes employer size, and they change over time. Treat any period you have heard quoted as the start of a conversation with qualified legal counsel, not as a rule, and check logging depth when comparing enterprise ATS options.

Intent, reasoning, and anything that happened outside the system. The log shows that a recruiter rejected forty candidates on a Tuesday. It cannot show whether the decision was sound. It records that a hiring manager viewed a profile, not what they concluded. Conversations in chat tools, phone calls and hallway decisions leave no trace at all, and those are frequently where the real decision was made. Trails also inherit limits from configuration, so if an integration writes changes under a single service account, every action it takes looks identical no matter which person triggered it. A log nobody reads provides no control either, only the possibility of one. The practical response is to keep decision reasoning in structured places such as scorecards and written notes, giving the trail something with substance to point at rather than bare timestamps.