Audit logs are for the day you hope never comes

Nobody has ever asked me to build audit logging. I build it anyway.

It is the least glamorous feature in any system: a table recording who did what in the admin area, and when. Which member of staff changed a product's status. Who issued the refund. Who updated a customer's account, edited a setting, cancelled an order. No customer ever sees it. No sales demo includes it. It earns nothing, ever.

Here is when it matters.

The day a second person gets admin access. From that moment, "who did this?" has more than one answer, and memory is not a record.

The day something disappears and a customer is furious. "A member of staff removed it on Tuesday at 14:32, and here is the reason they recorded" is a support reply. "We are not sure what happened" is a lost customer and a one-star review.

The day money moved and nobody remembers approving it. Refunds, credits, manual adjustments, anywhere staff hands touch money, an unanswerable "who authorised this?" is somewhere between an awkward meeting and a fraud investigation.

The day someone runs due diligence on the business. Any serious buyer or investor asks how access is controlled and evidenced. "We log all administrative actions" is a one-line answer. Its absence is a finding that makes everything else look worse.

And the day a dispute, commercial or legal, turns on who changed what, when. On that day a timestamped record is the difference between a factual question and a credibility contest.

The common thread: on every one of those days, the log is either already there or it is too late. Audit logging cannot be added retroactively. The record starts the day you begin writing it, and the incident you will need it for does not schedule itself around your plans. It is insurance, and you do not judge insurance by whether you needed it last month.

The good news is the cost. On the systems I build, every admin action lands in an audit log as a matter of course. The implementation is a table and a habit: who, what, which record, when, and enough before-and-after detail to reconstruct what happened, written from the same server-side code that performs each change so it cannot be skipped. Make it append-only; a log that staff can edit is worthless on exactly the day it is needed. Wire it into the admin code once and the cost of logging each new action rounds to zero.

An hour or two per admin screen, as it is built. Against that: the support ticket you can actually answer, the due-diligence question that takes one sentence, the dispute that stays factual. Some infrastructure earns its keep by being boring, precisely once.

If your site has an admin area and no record of what happens inside it, that is worth fixing before you need it.