Workflow Audit Trail Design
Design comprehensive audit logging for regulatory compliance:
- Regulatory scope: Which regulations apply? (FINRA, state insurance, SOX, GDPR, internal policy)
- Required events: Map every workflow action to an audit event (created, assigned, viewed, approved, rejected, modified, deleted)
- Required fields per event: timestamp (UTC), actor (user ID + role), item ID, before/after values, IP address, session ID
- Retention period: How long must audit records be retained? (typically 7 years for financial services)
- Access controls: Who can query the audit log? Read-only for compliance, no delete capability
- Export format: CSV, JSON, or direct to SIEM
Output: audit event catalog, data schema, retention policy spec, and access control matrix.