Audit trail, audit packs and exporting your data

Auditors, regulators and your own board want to know who decided what, when, and on what evidence. SupplierVault records every change, decision and approval as it happens, and those records can't be edited or deleted. You can then pull them together for one supplier as an audit pack, prepare a pack for a quarterly review, or export everything.

The Audit trail page

Open "Audit trail" from the main menu. "Every change, decision and approval is recorded here with who made it and when. Records cannot be edited or deleted."

• Each line shows When, Supplier or event ("General" if it isn't about one), What happened (for example "Invoice INV-104 logged (£1.2k)" or "Contract terms applied from the contract reader, checked by Sam Patel") and Who.
• Search with "Search what happened or who", or pick one supplier from the dropdown.
• Click a line to open that supplier's history.
• The page shows the latest 150 events ("Showing X of Y events"). Show more adds 500 at a time. In the live service the app starts with the latest 500 events; Load the complete history fetches the rest. The CSV downloads, audit packs and QBR packs always use the full history.

The panels on the page offer:

• "Audit report", "Download CSV": one row per supplier with area, tier, stage, owner, go-live controls passed, and for each onboarding form its status, who decided it and when, and how much evidence is attached, plus risk last assessed, sanctions result and notice deadline.
• "Complete activity log", "Download CSV": date and time, supplier, sourcing event, what happened and who.
• "Evidence recorded": how many evidence items are held across how many suppliers.

You only see events for suppliers in areas you have access to.

Why it can't be changed

The protection is built into the database, not just the screen. Nobody, including admins, can edit or delete an audit entry, and entries can only be recorded in your own name. Form evidence can be added but not deleted. The only exceptions are example data (which you can remove in one go) and closing your whole organisation.

Separately, the live service keeps a full change history of every record, with the before and after values and who made each change. It isn't shown on screen, but it's included in "Download all data".

Supplier audit pack

Open a supplier and click "Audit pack" at the top of the record. You get a web page file (open it and print to PDF), branded with your logo, showing who generated it and when. It includes:

1. Summary: area, tier, stage, supplier manager, created date, handover note
2. Go-live controls, passed or not
3. Forms and decisions: every onboarding form (and offboarding forms if exiting), whether it was required, its status, the last decision with who and when, evidence, and every question and answer. Bank numbers are masked.
4. Risk: inherent and residual risk, last assessment, sanctions, next re-assessment
5. Service improvements
6. Bank detail changes
7. ISO 27001 controls, FCA outsourcing record and related-party details, where you use those profiles
8. Documents (including removed ones) and purchase orders
9. Contract: start, end, notice period, committed value, notice deadline and when the renewal review starts
10. Tasks, with who completed them and when
11. The supplier's full activity history

Downloading a pack is itself logged ("Audit pack downloaded").

QBR pack

Click "QBR pack" on a supplier record for a ready-to-share quarterly business review pack (a web page file to print to PDF). It covers the latest scorecard quarter, or the last calendar quarter if there's no scorecard yet, with figures in your reporting currency:

• headline figures: overall score out of 5 and the change on last quarter, committed contract value, actual spend over 12 months, and invoiced this quarter;
• performance scorecard for the last four quarters, commentary, stakeholder survey results and any open issues or service credits;
• commercials: committed value, actual spend (invoiced and on order), invoices this quarter with any held or disputed, price escalator, savings recorded this quarter;
• contract and renewal: end date, notice deadline, change-figures deadline, recommendation and review status;
• obligations overdue and due in the next three months, and those met this quarter;
• risk, governance (sponsor, compliance %, meetings, decisions and actions) and service improvement;
• a list of up to 12 items that need attention or a decision at the review.

Scores are 1 (poor) to 5 (excellent), weighted as set in Settings. See Reviews and governance.

Evidence packs and the tamper check

The Audit trail page also has Evidence packs for auditors, which arrange your records control by control (ISO 27001, Cyber Essentials, UK GDPR Article 28, FCA outsourcing, related parties and a general supplier controls summary), and a Tamper check that proves the audit trail hasn't been changed. Auditors can also be given their own time-limited, read-only sign-in. See Audit evidence for auditors.

Documents and templates buttons

At the top of a supplier record, "Documents" takes you to the supplier's stored and linked files on its "Documents and history" tab, and "Templates" opens Document templates with that supplier already chosen, so contracts and letters are filled in from its record.

Download all data

In the live service an admin can export everything: open the account button (top right), choose the "Organisation" tab, and under "Your data" click "Download all data". You get a zip file containing:

Use it for your own archive, to move to another system, or before closing your organisation. Only admins can download all data.

Related

• Reports
• Security and data
• Account, team and security