Audit and compliance field guide

OSERP auditability means a reviewer can reconstruct what happened, who did it, why it was allowed, what data changed, and what ledger, stock, tax, or workflow effect followed. An audit log is not a substitute for good configuration: it must connect policy, source document, actor, approval, evidence, and result.

Audit event fields

Open Administration → Audit → Events.

Field	Example	Purpose and impact
Event ID	EVT-2026-009841	Immutable audit key
Tenant	tenant_demo	Isolation boundary
Company	company_uae	Legal context
Entity type	Purchase Order	Record family
Entity ID	PO-2026-004281	Drill-down target
Action	Approved	Behaviour recorded
Actor	user_8821	Responsibility
Role	CFO	Authority context
Timestamp	2026-09-17T10:45Z	Sequence and evidence
Previous value	AED 50,000	Change history
New value	AED 60,000	Change history
Reason	Budget revision	Explanation
Request ID	req_01J8	Technical trace
Correlation ID	corr_0041	Cross-system trace
Evidence	doc_budget_v2	Supporting proof

Events should record create, edit, approve, reject, post, reverse, allocate, export, login, permission change, bank change, tax override, and configuration change. Sensitive values are masked or hashed while preserving enough evidence to identify the object.

Source and downstream linkage

A transaction record should link to source type/ID, workflow tasks, attachments, journal IDs, stock movement IDs, tax lines, payment allocations, and webhooks. For a purchase receipt, a reviewer should move from PO to receipt to batch to invoice to GRNI journal and supplier payment.

If a downstream ID is missing, create an exception with owner and due date. A balanced journal without source evidence is not fully auditable.

Evidence and documents

Document fields include type, number, version, uploader, issued date, expiry, checksum, source, retention class, confidentiality, and access rule. Evidence may be quotation, contract, delivery note, tax certificate, bank verification, inspection, approval, or customer signature.

A replacement document creates a new version and preserves the old one. Expiry alerts have owner, escalation, and status. Delete rights are narrowly restricted; normal users archive or supersede rather than delete.

Retention and legal hold

Retention fields include record type, jurisdiction, retention years, start event, disposal date, owner, legal hold, and disposition approval. A legal hold pauses disposal and records authority, scope, and release date. Personal and health data may have different retention from financial records.

Disposal creates evidence of what was removed, when, by whom, and under which policy. Do not purge records needed for tax, audit, litigation, or contract obligations.

Access review fields

Access review records user, tenant, company, branch, warehouse, role, permission, reviewer, review date, decision, reason, and next review. Separate view, create, edit, approve, post, export, and administer rights. High-risk permissions include tax override, bank change, refund, journal adjustment, payroll export, and period reopen.

Terminated users lose access at approved effective time. Delegation and service accounts have scope, owner, expiry, and review. An access report should show dormant users, excessive scope, conflicting duties, and overdue reviews.

Reconciliation controls

Reconciliation definitions store source ledger, target ledger, dimensions, tolerance, period, owner, frequency, and evidence. Examples include inventory-to-GL, AR-to-customer statements, AP-to-supplier statements, bank-to-cash, tax-to-return, payroll-to-GL, and stock-to-count.

Each difference has amount, currency, account, source IDs, reason, owner, age, action, and approval. A manual write-off or adjustment references the difference and policy. Never close a reconciliation only because the total difference is small; materiality and ageing rules matter.

Period locks and close

Period fields include company, period, status open/soft-close/closed, lock date, tax filing date, close owner, exception threshold, and reopen authority. Soft-close may allow selected adjustments; closed periods require approved reopen or adjustment period.

The close checklist covers bank, AR, AP, inventory, GRNI, fixed assets, payroll, tax, FX, accruals, inter-company, projects, and suspense. Each task records owner, evidence, completion date, reviewer, and exception.

Exceptions and incident response

Exception fields include type, severity, entity, rule, detected time, owner, due date, status, root cause, corrective action, approval, and closure evidence. Examples are duplicate invoice, missing batch, expired certificate, unmatched cash, self-approval, bank change, or tax mismatch.

Security incidents record detection, affected tenant/company, data class, containment, notifications, root cause, and lessons learned. Do not put secrets or full personal data in incident comments.

Reporting and regulator packs

Reports should be reproducible by company, branch, period, account, partner, item, source, and status. A regulator pack identifies report version, filters, run time, preparer, reviewer, source snapshot, and hash or export reference.

Useful packs include journal listing, change log, approval history, user access, tax return support, inventory trace, supplier/customer statements, bank reconciliation, fixed-asset register, and period-close checklist. Every total drills to source lines.

API and event integrity

Audit APIs return event ID, tenant, company, entity, action, actor, old/new values, reason, evidence, request ID, and correlation ID. Consumers verify signatures, paginate with cursors, and store the last event sequence. Events are append-only; corrections add a new event.

{"eventId":"evt_009841","tenantId":"tenant_demo","companyId":"company_uae",
 "entity":{"type":"PURCHASE_ORDER","id":"po_004281"},"action":"APPROVED",
 "actorId":"user_8821","reason":"Budget evidence verified","correlationId":"corr_0041"}

Practice checklist

Run an access review, create a PO, approve and post it, edit a tax certificate, receive inventory, reconcile GRNI, close a period, attempt a backdated journal, and generate a regulator pack. Explain every audit field, evidence version, permission, retention rule, exception, source link, journal/stock impact, API ID, and reviewer action.

Related: Workflow and Approval field guide, Journal Entry field guide, Tax field guide, Company field guide, and API cookbook.