Before You Start

This guide assumes you have administrator access to QuickBooks Online. Familiarity with basic accounting principles will be beneficial for effective analysis.

Overview

30 min
Initial Review
Advanced
Difficulty
As Needed
Frequency

What You’ll Learn

  • How to access and filter the Audit Log effectively
  • Identifying different types of changes (deletions, modifications)
  • Tracking specific user activity and timestamps for accountability
  • Best practices for audit trail retention and regular review

1. Understanding Audit Trail Data Points

The QuickBooks Online Audit Log records crucial information for every change made in your company file:

Primary Data Points

  • User who initiated the change
  • Date and exact time of the change
  • Type of action (e.g., Created, Modified, Deleted, Voided)
  • Transaction or object (e.g., Invoice, Bill, Vendor, Customer) affected

Advanced Details (where available)

  • Original vs. new values for specific changed fields
  • The source of the change (e.g., web browser, mobile app)
  • Relevant system notes or related activities

2. Defining Your Review Scope

You have two primary approaches when conducting an audit trail review.

Method A: Focused Review

This approach targets specific known issues or suspicious activities that have already been flagged.

Pros:
  • Quick and efficient for known issues.
  • Targets specific areas of concern.
  • Requires less time and resources.
Cons:
  • May miss unrelated or hidden problems.
  • Relies on existing suspicions.
  • Limited in scope for overall security checks.

Method B: Comprehensive Audit

This approach involves a broader, systematic examination of all relevant user activities over a defined period.

Expert Tip: For critical periods (e.g., month-end, year-end) or when new users are granted elevated permissions, we strongly recommend performing a Comprehensive Audit. This provides a robust security check and baseline of normal activity.

3. Step-by-Step: Accessing the Audit Log

Here’s the general workflow to retrieve and understand audit trail data in QuickBooks Online.

The Audit Log in QuickBooks Online captures a detailed history of changes. Understanding the conceptual structure of these log entries is crucial for forensic analysis, even though QBO presents it in a user interface rather than a raw JSON output.

{
  "event_id": "audt_001A2B3C4D5E",
  "timestamp": "2025-10-20T14:30:00Z",
  "user_name": "John Doe (Admin)",
  "action_type": "DELETE",
  "object_type": "Invoice",
  "object_reference": "INV-00123",
  "description": "Invoice INV-00123 (Customer: Acme Corp, Amount: $500.00) was deleted.",
  "ip_address": "192.168.1.10",
  "details_of_change": {
    "previous_status": "Paid",
    "customer_id": "cust_ACME001",
    "total_amount": 500.00
  }
}

4. Filtering and Interpreting Results

  1. 1

    Navigate to the Audit Log

    In your QuickBooks Online account, click the Gear Icon () > Audit Log under ‘Tools’.

  2. 2

    Set Date Range and Users

    Use the ‘Filter’ button at the top to narrow down the time period you wish to investigate. You can also select specific users if you suspect particular individuals.

  3. 3

    Filter by Event Type and Object

    Crucially, filter for ‘Deleted’ or ‘Voided’ transactions to find missing entries, or ‘Edited’ to see modifications. You can also filter by specific object types like ‘Invoices’ or ‘Bills’.

Common Misinterpretation: Deleted vs. Voided

A deleted transaction is permanently removed from view (though traceable in the audit log). A voided transaction remains in the books with a zero value. Understand the difference to accurately assess financial impact and data integrity.

5. Forensic Analysis and Action

Forensic Checklist

  • Compare identified changes against expected business operations and policies
  • Identify unusual patterns, such as off-hours activity, repetitive deletions, or changes by inactive users
  • Document all suspicious activities, including timestamps, users involved, and impact on financial records
  • Discuss findings with compliance, management, or legal personnel as appropriate to determine necessary actions

Need Help?

Get Expert Support

Struggling with a complex audit trail investigation or need assistance with forensic accounting? Our team of experts can provide detailed analysis and guidance.

Contact Us