Audit Log Requirements: What to Track, How Long to Keep

"Who changed this deal price from $18,500 to $16,000?" Without audit logs, you'll never know. Was it an authorized manager discount, or an unauthorized staff member committing fraud? During regulatory audits, customer disputes, or internal investigations, audit logs are your only proof of what happened.

An audit log (also called activity log, change log, or transaction log) is a detailed, tamper-proof record of every action taken in your dealership management system: who logged in, what data they accessed, what changes they made, and when. Audit logs are critical for: regulatory compliance (proving who accessed customer data), fraud prevention (detecting unauthorized price changes, document alterations), and legal defense (evidence in customer disputes).

While no single law explicitly mandates "audit logs," regulations like FTC consumer protection rules, state privacy laws, and Canadian PIPEDA require dealers to demonstrate compliance - and audit logs are how you prove it. Dealerships without comprehensive audit logs face higher liability, inability to detect fraud, and failed audits.

This guide covers what to track in audit logs, retention requirements, compliance implications, DMS configuration, and how to use logs for fraud detection and audit defense.

Why Audit Logs Matter: Real-World Scenarios

Scenario 1: Customer Claims Contract Fraud

Situation: Customer claims you changed purchase price from $15,000 (verbally agreed) to $17,000 on signed contract.

Without audit logs: Your word vs customer's word. No proof of what actually happened. High risk of lawsuit, BBB complaint, regulatory investigation.

With audit logs: "Our logs show purchase price was entered as $17,000 on Jan 15 at 2:14 PM by Sales Rep John Smith. No changes were made after customer signed at 2:45 PM. Here's the timestamped log." Case dismissed.

Scenario 2: Regulatory Audit (Privacy Breach Investigation)

Situation: Customer reports receiving spam emails after purchasing from your dealership. Regulator investigates: "Who accessed this customer's email address?"

Without audit logs: Cannot prove who accessed data. Regulator assumes worst case (data breach, unauthorized access). Fines: $10,000-$50,000 per violation.

With audit logs: "Logs show only authorized sales rep (John Smith) and F&I manager (Jane Doe) accessed customer record on Jan 15. No exports to external systems. No unauthorized access detected." Audit passed.

Scenario 3: Internal Fraud Detection

Situation: Monthly financial reconciliation reveals $5,000 missing from cash deposits.

Without audit logs: No way to identify who processed transactions, when cash was recorded, or who accessed payment records. Fraud goes undetected until losses accumulate.

With audit logs: Review logs for cash transactions during missing period. Identify that Employee X processed 10 cash deals but only 7 were deposited. Flag for investigation. Employee terminated, losses recovered.

What to Track in Audit Logs

1. User Authentication Events

Track every login, logout, and access attempt to identify unauthorized access:

2. Data Access Events (Privacy Compliance)

Privacy laws (PIPEDA in Canada, state laws in US) require tracking who accessed personal information:

3. Data Modification Events (Fraud Prevention)

Track every change to critical data to detect unauthorized alterations:

4. System Configuration Changes (Security)

Track changes to system settings that affect security and compliance:

Audit Log Data Fields (Required Elements)

Every audit log entry must contain these fields to be useful for investigations and audits:

Audit Log Retention Requirements

Retention Periods by Jurisdiction

Best Practice: Use longest applicable period (7 years) to cover all jurisdictions and provide buffer.

Log Storage Requirements

• Immutability: Logs cannot be edited or deleted by users (append-only storage)
• Encryption: Encrypt logs at rest (AES-256) and in transit (TLS 1.2+)
• Access control: Only system admins can access logs (not sales staff)
• Backup: Daily backups to separate storage (prevent loss in hardware failure)
• Geographic redundancy: Store backups in different location (disaster recovery)

Using Audit Logs for Fraud Detection

Red Flags to Monitor (Automated Alerts)

Weekly Audit Log Review Checklist

• Failed login attempts: Review all failed logins. Investigate 5+ failures from same IP.
• After-hours access: Review logins outside business hours (6 PM - 8 AM). Verify legitimacy with users.
• Price changes: Review all deal price modifications > $500. Verify manager approval.
• Payment modifications: Review all cash payment entries. Reconcile with deposits.
• Document deletions: Review any deleted documents. Verify deletion reason.
• Permission changes: Review any user role changes. Verify authorized by owner.

DMS Audit Log Configuration

Essential DMS Features for Compliance

Audit Log Configuration Steps

1. Enable comprehensive logging: Configure DMS to log all events (authentication, data access, modifications, deletions)
2. Set retention period: Configure 7-year retention (longest required period)
3. Configure alerts: Set up automated alerts for red flags (failed logins, mass exports, after-hours access)
4. Restrict log access: Only owner/admin can view logs (not sales staff)
5. Test logging: Perform test actions (login, change price, delete document) and verify logs capture details
6. Schedule reviews: Calendar weekly log reviews (15-20 minutes to scan for anomalies)
7. Train staff: Explain audit logs to team: "Everything you do is logged. Unauthorized actions will be detected."

Audit Log Review During Regulatory Audits

Common Regulator Requests

Audit Preparation Checklist

• Test log export: Before audit, test exporting logs to CSV/PDF (verify readability)
• Review for gaps: Scan logs for missing entries (e.g., no logins on business day = logging failure)
• Prepare log summary: Create summary report: "Total logins: 1,245. Total price changes: 87. Total document deletions: 0."
• Document logging policy: Write policy: "All user actions logged. Logs retained 7 years. Logs immutable."
• Designate log custodian: Assign one person to retrieve logs for auditor (avoid confusion)

Frequently Asked Questions

Never lose track of who did what - comprehensive audit logs built in.

DealerOneView DMS includes tamper-proof audit logs tracking every user action: logins, data access, price changes, document deletions, and system configuration. Get automated fraud alerts, instant log exports for audits, and 7-year retention compliance.

See Audit Log System in Action →