Audit Trail in Accounting: What to Keep

An audit trail is the documented path that connects every number in your financial statements to the real-world transaction behind it: the quote, invoice, receipt, bank record and journal entry, plus who recorded each one and when. If an accountant, lender or IRS examiner picks any figure, a good audit trail lets you trace it back to source documents in minutes. It also makes errors and fraud much harder to hide.

This guide explains what an audit trail is made of, which records to keep and for how long, how to trace a sale and a purchase from start to finish, and how to keep a clean digital trail when you work with cloud software and scanned receipts. This is general information, not tax or legal advice; your accountant can confirm requirements for your business.

What an audit trail is made of

Every complete audit trail has four layers:

1. Source documents: invoices, receipts, contracts, purchase orders, timesheets, bank statements.
2. Accounting entries: the journal entries that record each transaction with a date, accounts, amounts and description.
3. Ledgers and reports: the general ledger, trial balance and financial statements built from those entries.
4. Change history: who created, approved, edited or deleted each record, and when.

The links between layers are what matter. An invoice number on the journal entry, a check number on the bank reconciliation, and a purchase order number on the supplier invoice let you move up and down the trail without guessing.

Sales tax deserves its own mention. If you collect sales tax, keep exemption and resale certificates from customers, records of where each sale was delivered, and the returns you filed, because states examine these separately from income tax and often look back several years. A sale with no tax charged and no certificate on file is usually treated as taxable in an audit, with the tax owed by you rather than the customer.

Records to keep and for how long

The IRS guidance on how long to keep records ties retention to the period in which a return can be examined:

Situation	Keep records for
Most income tax records	3 years from filing
Claim for credit or refund filed after the return	3 years from filing or 2 years from payment, whichever is later
Unreported income over 25% of gross income shown	6 years
Loss from worthless securities or bad debt deduction	7 years
Employment tax records	At least 4 years after the tax is due or paid, whichever is later
No return filed, or fraudulent return	Indefinitely
Records for property and equipment	Until the period expires for the year you dispose of the asset

Lenders, insurers, state agencies and contracts may require longer periods, so many small businesses simply keep core accounting records for seven years. Our guide on how long to keep invoices covers country-specific rules, including the UK and EU.

Documents that belong in the trail

• Sales: quotes or estimates, contracts, invoices, credit notes, payment receipts, deposit records.
• Purchases: purchase orders, supplier invoices, receiving records, receipts, proof of payment.
• Banking: monthly statements, deposit details, reconciliations.
• Payroll: timesheets, pay records, tax filings, W-4s and contractor W-9s.
• Assets: purchase invoices, depreciation schedules, sale documents.
• Owner transactions: contributions, draws, loans to and from the business, with a short note on each.
• Adjustments: any manual journal entry, with the reason and who approved it.

Worked example: tracing a sale from quote to bank

The figures are illustrative. A landscaping company's accountant picks a $4,250 revenue entry dated 14 August from the general ledger and asks for support. A clean audit trail produces this chain in a few minutes:

Step	Document	Reference that links it
1. Quote accepted	Estimate EST-0312, signed 2 August	Client name, job 2026-118
2. Work completed	Crew timesheet and materials receipt	Job 2026-118
3. Invoice issued	Invoice INV-1047, 14 August, $4,250, net 15	References EST-0312 and job number
4. Journal entry	Debit receivables $4,250, credit revenue $4,250	Memo: INV-1047
5. Payment received	ACH remittance, 27 August	Remittance shows INV-1047
6. Bank deposit	August bank statement line, $4,250	Matched in bank reconciliation

If any link is missing, for example an invoice without a number or a deposit that combined several payments with no remittance detail, the accountant has to reconstruct the chain from emails and memory. That costs time and fees, and in an examination it can cost deductions or credibility. Matching payments to invoices each month through a bank reconciliation keeps step 6 tidy.

Invoice practices that protect your audit trail

• Sequential, unique invoice numbers. Gaps raise questions. See our guide to building an invoice numbering system, or use the invoice number generator.
• Never delete an issued invoice. Void it or reverse it with a credit note. Our guide on how to void an invoice walks through it.
• Reference the source: quote number, purchase order number, job number or contract on each invoice.
• Keep the version you sent. Save the PDF exactly as delivered, not just the data in your tool.
• Record payment details: date, method and reference for every payment received.

The free invoice generator lets you add an invoice number, PO reference and payment terms, and download a PDF copy for your records.

Building a digital audit trail: step by step

1. Give every user their own login in your accounting software and bank. Shared logins erase accountability.
2. Limit who can delete or edit posted entries, and close prior periods once reconciled so they cannot be changed silently.
3. Turn on and review the audit log in your software at least monthly, looking for edits to closed periods and deleted transactions.
4. Attach documents to transactions: scan or photograph receipts and attach supplier invoices to the bill entry.
5. Use a consistent file naming system, such as YYYY-MM-DD_vendor_amount, for any documents stored outside the software.
6. Back up to a second location, and export reports and the audit log at year end.
7. Archive before switching software, since history and logs often do not migrate.

The IRS accepts electronic records that are accurate, complete and retrievable. If you scan paper receipts, make sure the date, amount, vendor and items are legible.

Audit trails for payment processors and marketplaces

Card processors, PayPal, Stripe, Square and marketplaces deposit net amounts: customer payments minus fees, refunds and chargebacks, often combining many sales into one payout. Recording only the payout breaks the trail, because revenue and fees disappear into one number. Instead:

• Download the processor's payout or settlement report each month.
• Record gross sales, fees, refunds and chargebacks separately, then match the net payout to the bank deposit.
• Keep the processor reports with your records, since they may be the only link between a customer invoice and the bank.
• Reconcile against Form 1099-K if you receive one; the form reports gross payments, not your net deposits.

Who relies on your audit trail

Who	What they check
Your accountant or tax preparer	That income and deductions are complete and supported
IRS or state tax examiner	Source documents behind reported income, expenses and sales tax
Lender	That statements match bank records and receivables are real
Buyer of the business	Revenue quality, customer concentration and unusual adjustments
Insurer after a theft or loss	Proof of the amount lost
Customers in a dispute	Signed quotes, change orders, delivery records and invoices

Audit trails and internal controls

An audit trail records what happened; internal controls decide what is allowed to happen. They work together. Approval of supplier invoices before payment, matching invoices to purchase orders and receiving records through a three-way match, and separating who records transactions from who handles cash all leave evidence in the trail. Those links are what let you catch a duplicate payment or a fictitious vendor. In a small team, splitting tasks is harder; our guide to segregation of duties shows practical workarounds.

Common audit trail mistakes

• Cash sales with no receipts or a single daily total with no detail.
• Owner paying business expenses personally without recording the reimbursement or contribution.
• Bank deposits that lump several customers together with no breakdown.
• Manual journal entries with no explanation, especially at year end.
• Editing last year's books after taxes were filed. Corrections should go in the current period with a note.
• Relying on email as a filing system. Inboxes get purged; move documents into your records.

What to do if your audit trail has gaps

Start with the bank statements, which are complete and independent. Request copies of missing supplier invoices; most suppliers can reissue them. Rebuild missing sales records from bank deposits, payment processor reports and customer statements. For a missing invoice number, document why it is missing in a memo. Then fix the process that caused the gap. If you are facing an examination, our invoice audit preparation guide covers what to assemble first, and a tax professional can advise on how to present reconstructed records.

A clean audit trail costs a few minutes per transaction and saves days when a question comes. It starts with a properly numbered invoice that references the work and the customer's purchase order. Create yours with the free invoice generator, with no sign-up needed, and download each invoice as a PDF for your files.