Risk and Compliance5 min read

"Who changed this rent amount?" The case for audit trails

Cover with the words who changed this rent, and cards showing an old amount, a new amount and no record of who changed it

An audit trail is a permanent record of who changed a figure, when, from what value to what value, and why. Property firms need one because rent, owner balances and bank details are changed every day. Without it, a simple question from an owner or auditor has no reliable answer.

Take an example. An owner calls. Their rent for a unit dropped by AED 4,000 at renewal. They want to know why, and who agreed it.

It is a fair question. In many firms, it starts a small investigation. Someone opens the rent roll. Someone searches their inbox. Someone remembers a WhatsApp message from March. An hour later there is a likely answer, but no proof.

The rent may well be correct. That is not the point. The firm cannot show it.

What an audit trail actually is

An audit trail is a record of changes that nobody can quietly edit. For each change, it holds six things:

  1. Who made the change.
  2. What record was changed.
  3. The old value.
  4. The new value.
  5. When it happened.
  6. Why, where a reason is needed.

What one audit trail entry looks like

  • 14 Mar10:42, changed by leasing manager
  • AED 92kold annual rent
  • AED 88knew annual rent
Illustrative entry. Reason: renewal, approved by the finance manager at 11:05.

The trail is created by the system, automatically, at the moment of the change. Nobody has to remember to write it down. That is what separates it from a note in a file or a comment in a cell.

Why a spreadsheet cannot do this

Spreadsheets are excellent tools for analysis. They make poor systems of record. The reasons have nothing to do with the skill of the people using them.

A cell can be overwritten and the old value is gone. A formula can be replaced by a typed number, and it looks the same. A file can be copied, so two versions drift apart. Then someone asks which is correct, and the most recent date on a file does not settle it.

Some tools keep a version history, which helps a little. But a history of a file is not a controlled record of a rent. It does not ask for a reason. It does not stop one person from changing a figure and approving it too. And it knows nothing about the copy on someone’s laptop.

This is the safe option that turns out to be the risky one. The spreadsheet feels familiar and under control. In practice, nobody can tell you what happened to it.

Where it matters most in property operations

You do not need to record everything with the same care. Start with the records where a quiet change costs money or trust.

Record Why it matters Second approver?
Rent and service charges Drives invoices and statements Yes, above a set change
Bank details Common route for payment fraud Always
Write-offs and credit notes Can make arrears disappear Always
Owner balances Money held for others Yes
User access Who can do all of the above Yes

Rent and service charge amounts. These drive invoices, owner statements and budgets. A change here flows into everything downstream.

Bank details. A changed vendor or owner bank account is a classic route for payment fraud. Every change should be visible and approved by a second person.

Write-offs and credit notes. Arrears can be made to disappear with one entry. That entry should always have a name and a reason on it.

Owner balances and allocations. You hold this money on behalf of others. See what a banker checks first for why this is the first thing a risk officer looks at.

User access. Who was given rights, by whom, and when were they removed? This is often missed, and it matters most when somebody leaves.

A trail changes behaviour

There is a benefit that rarely appears in a business case. People behave differently when changes are visible.

This is not about suspicion. Most staff are honest and want to do the job well. A clear trail protects them. When a figure is questioned, an honest employee can show exactly what they did and who approved it. Without a trail, that same employee has only their word.

It also takes the heat out of disputes. A conversation about whether someone made a mistake becomes a five-minute look at the record.

What an auditor is really asking

When an auditor asks to see how a figure was changed, the request is simple. They want evidence that your controls worked.

Answering "who changed this?"

Without a trail
  • Open old file versions
  • Search inboxes and chats
  • Ask whoever remembers
  • Hours, and still a guess
With a trail
  • Open the record
  • Read the history
  • See who, when and why
  • Minutes, with proof

A firm with a trail shows the record. A firm without one assembles a story from emails, chat messages and memory. Even when that story is true, it takes far longer to tell, and it is harder to believe.

The same applies to a board, or to an owners association asking about service charge spending. If the question is “can you prove it?”, the only useful answer is a record made at the time.

Three common objections

“We are too small for this.” A small team has fewer people to catch a mistake, and more key-person risk. If anything, the trail matters more.

“Our people are trustworthy.” Almost certainly. Controls are not an accusation. They protect those people when something is questioned.

“It will slow us down.” Recording a change takes no extra effort when the system does it. The slow part is the investigation that happens later, as described in owner statements built by hand.

Check this on Monday

Choose one unit where the rent changed at the last renewal. Ask your team to show who changed it, the old and new amounts, who approved it, and the reason.

Set a timer. Do not accept “I think it was”. Perhaps the answer takes more than a few minutes, or depends on one person’s memory. If so, you have found the gap.

If an owner asked you this question today, what could you actually show them?

Common questions

What is an audit trail in property management?

It is an automatic, permanent log of changes to important records. For each change it shows the user, the date and time, the old value, the new value and ideally the reason.

Does a spreadsheet have an audit trail?

Version history in some spreadsheet tools shows that a file changed, but it is not a control. It can be hard to read, it does not capture a reason, and copies of the file sit outside it.

Which records need an audit trail first?

Start where money and trust are at stake: rent and service charge amounts, owner and vendor bank details, write-offs and credit notes, and user access rights.

Real Estate Operational Risk Scorecard

A 20-question self-assessment is in preparation. Leave your email on the newsletter form to hear when it opens.

Asif Aftab

Asif Aftab

Real Estate Operations, Risk & Systems Advisor. 20 years in banking risk. Founder, Inovada.

Read next