Audit Trail Requirements for Research
Why a research process needs a durable, tamper-evident record of what was tried, what data was used, and who decided what — not just the final strategy that made it to production.
Six months after a strategy launches, a regulator or an internal reviewer asks a simple question: how was this idea developed, what data did the researcher have access to at the time, and who approved it going live? If the answer is "let me check the researcher's laptop and ask around," the firm has a problem — not necessarily because anything was done wrong, but because it can't prove what was done at all. An audit trail is the record that lets a firm answer that question with evidence instead of memory.
A useful audit trail covers more than the final, successful strategy. It captures the sequence: which datasets were pulled and when, which versions of the code produced which backtest results, which approvals were given at each stage-gate, and who signed off before capital was committed. The point isn't bureaucratic completeness for its own sake — it's that research decisions get questioned later, often much later, and the person who made the decision may no longer be at the firm or may simply not remember the details. A written, timestamped record settles disputes that a recollection can't.
The record also has to be tamper-evident, meaning changes to it are visible rather than silent. A spreadsheet that anyone can edit after the fact isn't really an audit trail — it's a document that happens to look like one until someone needs to trust it. Version-controlled code repositories, immutable logs, and approval systems that record who clicked "approve" and when are the practical tools that make a trail trustworthy rather than just tidy.
This matters most exactly when things go wrong. If a strategy loses money unexpectedly, or a regulator asks whether a researcher had access to material nonpublic information at the time an idea was developed, the audit trail is what lets the firm reconstruct the timeline precisely instead of relying on someone's best recollection weeks or months later — a difference that matters both for getting the right answer and for the firm's credibility in giving it.
An audit trail for research is a durable, tamper-evident record of what data was used, what was tried, and who approved what and when — built so the firm can reconstruct a decision precisely later, not just remember it approximately.
A good rule of thumb: if a question that starts with "who decided" or "when did we know" can't be answered by pulling a log or a repository history, the audit trail has a gap worth closing before it's needed under pressure.
Further reading
- Federal Reserve SR 11-7, Guidance on Model Risk Management