Every change, and what it looked like before.
Not a log of who signed in. The row as it stood, the row as it became, which columns moved, who moved them and from where — on every table, appended and never edited.
| employee_rates | R. Montesclaros · 645.00 → 780.00 | update | M. Bautista |
| purchase_orders | PO-202609-00219 · approved | update | R. Yap |
| journals | JV-202609-00184 · posted | insert | C. Yap |
| fiscal_periods | August closed · reason recorded | update | C. Yap |
| trial balance | refused — no rows returned | read | warehouse |
| Tables covered | every one that holds a record | 105 |
An append-only audit trail across every table, with the row before and after each change, plus the reconciliations an accountant signs against.
What it actually does.
Append-only, enforced by the database
Not a convention. The table refuses an update or a delete outright, so a trail that disagrees with the books cannot be quietly tidied — including by us.
- The row before and the row after, with the columns that actually changed.
- Who, when, from which address and country, and through which client.
- A correction is a new entry that links to what it corrects; nothing is overwritten.
Amber is their own people only. Payroll and HR rows are decided one at a time, which is what makes the trail something you can hand to somebody.
It is scoped, so it can be shown to people
An audit trail everybody can read is one nobody can be given. Payroll and HR changes are visible only to whoever may see the underlying record, decided per row rather than per table, so a bookkeeper can be handed the trail without being handed the salaries.
- A manager sees their own people, a controller sees the company.
- Private personnel documents stay private in the trail as well as on the screen.
- What somebody cannot see is absent, not blanked — there is nothing to infer from.
Both sides come from different places. A check that reads the same source twice proves nothing at all.
The controls an accountant actually signs
Sub-ledgers reconciled to control accounts from independent sources, the paper tied back to the books, and a close that will not complete while something is unposted.
- A period closes on a checklist; reopening it takes a written reason.
- Reserved permissions are the one thing a wildcard does not grant.
- Refusals are recorded too — a trail of only what succeeded is half a trail.
The ones people ask about this.
Is this the BIR’s CAS audit trail requirement?
It is what that requirement asks for and more: the before and after of every change, not only that a change happened. The CAS registration pack reads from it.
Can somebody with database access edit it?
The table refuses updates and deletes through a trigger, so an edit fails rather than succeeding quietly. What an administrator could do to any database is a reason to keep the trail somewhere they cannot reach, which is a hosting question and we will answer it.
How long is it kept?
All of it. It is not rotated or summarised, and the oldest entry is the first change this business ever made in the system.
Can I see what one person did last Tuesday?
Yes — by person, by day, or by record. Every figure on the activity screen opens the entries behind it, the same as everywhere else.
Nothing here is a separate product.
Security & access
Enforced in the database, down to the action
See the pageAccounting
Multi-entity double-entry, consolidation, intercompany
See the pageApprovals
Who signs off what, by amount, with nobody approving their own
See the pageTax & BIR compliance
Books of accounts, VAT, SLSP, 2307, CAS
See the pageSee it on your own figures.
Bring one ordinary day from your business and we will run it through in front of you, on your own items and your own prices.