QuickBooks Audit Log: Trace Changes Before You Edit

The QuickBooks audit log can help explain an unexpected change before anyone edits the books again. Start with the affected record, then trace the activity and compare its history. This workflow helps business owners prepare a focused QuickBooks cleanup discussion without treating an unfamiliar user label as proof of an error.

Use the audit log to find company activity by user, date and event. Then open the specific transaction history to compare changes. Distinguish named users from automatic system activity and accounting-firm labels. Finally, keep the original evidence and ask a precise question before correcting anything. A recorded change does not, by itself, establish a mistake or identify the reason behind it.

By Adham Abadier, CPA — Licensed in California, License #158599

Key Takeaways

• Start with one affected record and a clear question, not a bulk correction.
• Use company-level filters first, then inspect the transaction-level history.
• Read system and firm labels in context before assigning responsibility.
• Keep evidence separate from the proposed correction and approval.

Start a QuickBooks audit log investigation with one question

An invoice amount changed, a customer detail looks different, or a record no longer appears where expected. First, write down what you noticed and which record it concerns. Keep the invoice reference, account, report period and any earlier copy together. These are practical documentation steps, not a claim that every difference requires a correction.

Next, confirm access. Intuit says users need admin access to see the QuickBooks audit log. If it is unavailable, contact the primary admin rather than sharing a password or creating another company file. Also distinguish access to the log from permission to change the underlying records. (Intuit: Use the audit log)

The log covers more than payments and invoices. For example, Intuit lists sign-ins, settings changes and edits to customers, vendors and employees. Therefore, choose the question before narrowing the search: an account-access concern and a changed invoice need different evidence. (Intuit: Use the audit log)

Filter the QuickBooks audit log before drawing conclusions

In QuickBooks Online, open Settings and select Audit log. Choose Filter, then use the User, Date or Events fields to narrow the results. Select Apply. Follow the current labels in the company file, since product screens can change. (Intuit: Use the audit log)

Start with a date range that includes the suspected change. If that produces no useful result, reconsider the range or event filter before declaring the record absent. Note which filters you used so another person can repeat the check. Likewise, avoid filtering to one person too early when the source of the change is still unknown.

After locating an entry, select View in the History column. Intuit describes this as the route into the audit history for that transaction. Keep the original reference beside the history so similarly named customers or equal amounts do not become a mistaken match. (Intuit: Use the audit log)

An unexpected change needs an explanation? Discuss the records and a focused cleanup scope with Catalyst CPA.
📞 (951) 223-1826  |  Book a free 30-min call →

Compare transaction history with the QuickBooks audit log

The company log helps locate activity; transaction history focuses on one record. Intuit says that history shows who changed it, when and what changed. Users need full access rights to view it. As a result, an access limitation should remain an access question, not a conclusion that no history exists. (Intuit: View transaction history)

For a transaction you already have open, select More actions, then Audit history. Choose Show all for an expanded view or Compare for a side-by-side comparison. These are inspection steps, not instructions to save a new version. (Intuit: View transaction history)

Now compare the recorded change with the original invoice, receipt or other relevant evidence. Record the old and new details that matter to the question. However, keep interpretation separate: the history may show an amount changed, while the supporting document explains whether the change was appropriate.

Read QuickBooks audit log user labels in context

A system label is not automatically a sign of unauthorized access. Intuit identifies Online Banking Administration for automatic connected-bank changes and System Administration for automatic QuickBooks activity. Its examples include connected-app updates, recurring transactions and changes to one record that affect another. (Intuit: Use the audit log)

For example, changing a payment link can affect the original invoice. Consequently, investigate the related record before assuming someone directly edited every item shown in the history. A Support Representative label identifies changes by a QuickBooks support consultant, while Import Administration relates to conversion from Desktop. (Intuit: Use the audit log)

Firm attribution needs care too. In the Intuit example, the client and a second accounting firm can identify which firm made a change. People within that firm can identify their colleague. Therefore, ask the relevant firm to clarify its activity instead of assuming every viewer sees the same individual name. (Intuit: Client and accountant visibility)

Keep a QuickBooks audit log worksheet before any correction

Use a short worksheet to turn the history into a focused question. The following fields are organizational recommendations, not a required QuickBooks report. In particular, separate what the record shows from what someone still needs to confirm.

Observation	Evidence to retain	Question to resolve
A transaction changed	Reference, history and original supporting document	Which change is supported, and why?
A system label appears	Event details and any related app or transaction	What process explains this activity?
An accounting-firm label appears	Firm label, event date and affected record	Who at that firm can explain the change?
History is missing or inaccessible	Search filters, account context and access limitation	Does the search or access need clarification?

Finally, agree on the next step before editing a completed period. Keep the evidence, proposed action and person responsible together. If the change concerns a statement mismatch, use the separate statement reconciliation checklist for that comparison. This article investigates activity; it does not prescribe a balancing entry or a restoration procedure.

Frequently Asked Questions

What does the QuickBooks audit log show?

It records company activity, including financial transactions and certain settings or user actions. Use its filters to find the event, then inspect the available history. The log is evidence to investigate, not a verdict about whether a change was correct. (Intuit: Use the audit log)

Does a system entry mean someone made an unauthorized change?

Not by itself. Intuit documents automatic system activity, including app updates and effects on related records. Check the specific event and source before assigning a cause. (Intuit: Use the audit log)

Can everyone see the same accountant name?

Not necessarily. In the documented client-and-firm example, some viewers identify the firm while its own users can identify the individual. Ask the firm to explain the event when that distinction matters. (Intuit: Client and accountant visibility)

How long is the activity available?

Intuit states that audit-log events remain available for two years. It also says the log cannot be turned off. Keep relevant evidence through the agreed secure records process; this product limit is not advice about legal retention periods. (Intuit: Use the audit log)

FREE FOR BUSINESS OWNERS

Discuss an Unexplained Change

Book a free introductory call to discuss the affected records and possible cleanup scope. Any bookkeeping work needs an agreed engagement. This call is not an audit, financial-statement review or assurance service.

Book Your Free Call →

Next step: turn the QuickBooks audit log into a clear question

A useful investigation ends with a supported explanation or a specific unresolved question. First preserve the history; then discuss any correction and its scope. Explore Catalyst CPA’s QuickBooks cleanup services or call (951) 223-1826 when the records need further attention.

Sources

• Intuit: Use the audit log
• Intuit: View transaction history
• Intuit: Client and accountant visibility

About the Author