{
  "question_id": "CG-P1B-FULL-037",
  "slug": "how-to-find-deleted-or-changed-transactions-in-the-audit-log",
  "display_title": "How do I use the audit trail or change log in my accounting software to find transactions that were deleted or altered?",
  "format": "article-v2",
  "applies_to": {
    "countries": [
      "US"
    ],
    "frameworks": [],
    "tax_year": null,
    "platforms": [
      "QuickBooks Online",
      "Sage 50"
    ]
  },
  "general_concept": true,
  "summary": "Using a login that can open the change history (admin in QuickBooks Online and Zoho Books), set whatever date, user and event filters it offers to the window in question, not the defaults. Open each matching entry to see what changed, under which login and when, then check the register to learn whether the transaction was deleted, altered, voided or never recorded. Save the entries before anyone keeps working in the file, and escalate any change nobody can explain.",
  "body": "## What order should you work in?\n\nWork through the investigation in this order, because each step depends on the one before:\n\n1. Define the window, from the last date the figure was known to be right, such as a finished reconciliation or a report you sent out, through today.\n2. Open the change history and set whatever date, user and event filters it offers to that window.\n3. Isolate the entries that touch the transaction, its amount, its reference, or the customer, vendor or account it belonged to.\n4. Read each entry for what changed, under which login and when.\n5. Trace each entry to the register to see whether the transaction was deleted, altered, voided or never recorded.\n6. Capture the entries and the transaction's current state before anyone edits anything.\n7. Decide whether the finding is a routine correction or goes to the file owner or accountant.\n\n## Where is the change history, and can your login open it?\n\nEach product puts the view in its own place, and Intuit and Zoho say who can open theirs:\n\n- **QuickBooks Online.** Intuit's audit log article says to go to Settings and select Audit log; its article on re-entering deleted transactions gives the route as Settings, then Tools, then Audit log. Intuit's audit log article lists admin access among its requirements and tells anyone who cannot see the log to contact the primary admin to get access. For a single transaction, Intuit's audit history article has you open it, select More actions, then Audit history, and says only users with full access rights can view that history.\n- **Zoho Books.** Zoho's audit trail FAQ says you must be an Admin in the organization to view the audit trail. The FAQ's route runs from the Reports module through Activity to the Activity Logs & Audit Trail report, where you select View Audit Trail on the right side of the activity you want to check.\n- **Sage 50.** Sage's help topic on printing the Audit Trail report starts from the Reports & Forms menu, where you select Company and then the Audit Trail report. Sage's 2026 U.S. audit trail topics say the feature is available in Sage 50 Premium Accounting and higher but do not say which users can open it.\n\nIn other software, look in the reports or settings menus for an audit log, audit trail, activity log or history view.\n\nIf your login cannot reach the view, ask the file owner or an admin to open it with you or to grant access. If the person whose changes you are checking is the one who controls access, go to the owner instead. Designing roles for the whole file is a separate question about users and permissions.\n\n## What does the change history record, and what does it leave out?\n\nWhat each product keeps decides which questions its log can answer:\n\n- **QuickBooks Online.** Intuit's audit log article says QuickBooks Online tracks not only financial transactions but all account activities in the audit log, and that a deleted transaction, such as a deleted invoice, can be found by searching the log. Intuit's audit history article calls the per-transaction view a record of all the changes made on a specific transaction and offers a side-by-side comparison, so earlier values can be read next to current ones.\n- **Zoho Books.** Zoho's audit trail FAQ says a new version of a transaction is created each time it is changed, and that the audit trail shows the current version with a list of all previous versions. Its comparison of two versions highlights fields that were modified, added or deleted in yellow, green and red. The FAQ does not say whether a deleted transaction appears in the Activity Logs & Audit Trail report, so a missing delete entry there does not prove nothing was deleted.\n- **Sage 50.** Sage's page on what the audit trail tracks lists the system (computer) date of each action, the user name, whether the action was an Add, Change or Delete, the window where it occurred, and the transaction's reference number and amount after the change.\n\n  Those items omit the transaction's own date and accounts, and Sage records its ID, reference and amount only as they stood after the change. An earlier entry for the same transaction shows their earlier values if your date range reaches it, so widen the range. A changed date or account shows only as a Change, so establish what moved from the register and from reports saved before the change.\n\nEven a complete entry leaves three questions open:\n\n- Why the change was made, which has to come from source documents and the people involved\n- Which person made it, because the entry names a login\n- Whether a missing transaction was ever entered, because one that never was leaves no entry, so an empty result is not proof of deletion\n\n## How do you narrow the log to the events that matter?\n\nSet every filter yourself, because an event outside the selected dates or event types simply does not appear, and an empty screen then looks like proof that nothing happened. Work the filters this way:\n\n- **Date.** Filter on when the change could have been made, which can be months after the transaction's own date.\n- **User.** Run the window for all users first, then narrow to one login, because a change made under an unexpected login is itself a finding.\n- **Event type.** Include deletions, voids and edits together, and narrow only once you know which kind you are dealing with.\n\nIn QuickBooks Online, Intuit's audit log article says to choose the User, Date or Events filter on the Filter panel to narrow the results, and that results show 150 records at a time. Intuit's article on re-entering deleted transactions suggests using the browser's search for the word \"deleted\" to spot deletions; with results in sets of 150, narrow the date range until they fit in one set, or repeat the search on each set, before treating a failed search as a result. In Sage 50, Sage's printing topic has you select a date range in the Filter window and, to order the report by user, select User ID as the Report Order option.\n\nZoho's FAQ says the Activity Logs & Audit Trail report shows the activities during a certain period and describes no user or event filter, so read every activity in a period that covers your window. Sage's printing topic describes no event filter, so read each entry's Action (Add, Change or Delete). Intuit's audit log article, Zoho's FAQ and Sage's printing topic describe no transaction-type filter, though in Sage 50 the window name, such as Sales Orders, shows where each action occurred.\n\n## How do you read one entry?\n\nTake an invented entry, laid out the way a before-and-after comparison shows it. A bill from Coastal Paper Co., reference 4471, was edited under the login ap.clerk on June 18 at 4:52 PM:\n\n| Field | Before | After |\n|---|---|---|\n| Bill date | March 28 | April 3 |\n| Amount | 1,480.00 | 148.00 |\n| Vendor | Coastal Paper Co. | Coastal Paper Co. |\n| Reference | 4471 | 4471 |\n\nRead it field by field:\n\n- **Which transaction.** The vendor and reference identify bill 4471. Open it from the entry and confirm the register shows the same bill.\n- **What changed.** The amount fell by 1,332.00, and the date moved from March into April. On an accrual-basis profit and loss, with the bill coded to an expense account, March expenses therefore dropped by 1,480.00, while April gained 148.00.\n- **Who.** The change came through the login ap.clerk, which identifies an account, not yet a person.\n- **When.** The time is when the change was made, not the bill's date. Sage's page on what the audit trail tracks says its time is the system (computer) time of the action, so a wrong computer clock gives a wrong time.\n- **What it does not establish.** The entry does not say why the change was made or whether it was right. Check both changed fields against Coastal Paper's invoice 4471.\n\n  If it reads 148.00 dated April 3, the edit corrected two keying errors; if 148.00 dated March 28, the amount was corrected but the move into April needs an explanation; if 1,480.00, the bill is now understated by 1,332.00 and the change needs an explanation. Because the edit moved a bill out of March in June, check whether March was already reconciled or reported before closing the finding.\n\n## Was the transaction deleted, altered, voided or never recorded?\n\nEach explanation for a missing or changed figure calls for a different next step:\n\n| What the log and register show | What it means and what to do next |\n|---|---|\n| A delete event, and the transaction is nowhere in the register | Deleted. Capture the entry's detail first, because in QuickBooks Online it holds what the transaction contained; a Sage 50 entry holds at most the transaction's ID, reference and amount. |\n| An edit event, and the transaction is still in the register with a different amount, account or party | Altered. Compare the before and after values with the source document. |\n| An edit that changed the date | Re-dated. The transaction still exists but now sits in another period's reports, so search the register across both periods. |\n| The transaction is still there at zero and marked void | Voided. In QuickBooks Online, it stays in the books but no longer counts in totals. |\n| The transaction is not where expected, and its customer, vendor or account was changed, merged or renamed in the window | Moved. Check whether the transaction now sits under another name or account, for example after a merge or rename, by searching the register by amount or reference. Intuit's audit log article, Zoho's FAQ and Sage's audit trail topics do not say how a merge appears in the log, so rely on that register search. |\n| No event of any kind, in a window the log covers | The log alone does not settle it. Intuit's article on re-entering deleted transactions notes that the audit log only works for transactions that were saved; it does not say what an empty window shows, and a transaction saved and deleted before your window leaves no event in it either. Check the bank statement, invoice or receipt before concluding it was never recorded. |\n\nIn QuickBooks Online, Intuit's article on voiding and deleting says deleting removes a transaction everywhere except the audit log.\n\nThe log is evidence, not an undo. Intuit's article on re-entering deleted transactions says a deleted QuickBooks Online transaction can't be restored, though the details in the log can be used to re-enter it by hand. Whether and how to re-enter it is a separate correction question; in a contested matter, capture the evidence first.\n\n## How do you trace an entry back to the books?\n\nThe trace turns a log line into a finding about the ledger:\n\n1. Open the entry's detail. In QuickBooks Online, Intuit's audit log article says selecting View in the History column opens the audit history for that specific transaction; if the transaction still exists, open it as well.\n2. Find the transaction in the account register. Intuit's article on account registers says the Find field searches by amount, reference number or memo, so search the before value, the after value and the reference.\n3. Set the register's dates wide enough to cover every period the transaction could have moved into before concluding it is gone.\n4. Rerun the report that first looked wrong for the affected periods, and note how much of the difference the change explains.\n5. For a deletion, record that the searches by amount, reference and memo found nothing, because that confirmed absence, together with the delete entry, is the finding.\n\n## Whose name is on the change?\n\nThe user column names the login that made the change, and what it says about a person depends on how logins are issued:\n\n| Login arrangement | What the user column can tell you |\n|---|---|\n| Each person has an individual login | The entry points to that login's holder, provided nobody else knew the password. |\n| Several people use one shared login | The entry shows the change came through that login and nothing more. It cannot tell you which person made it. |\n| QuickBooks Online system users | Intuit's audit log article says System Administration shows changes made automatically by QuickBooks Online, Online Banking Administration shows automatic changes related to connected bank accounts, and Support Representative shows changes made by a QuickBooks Online support consultant. The same article adds that a System Administration event can follow a person's own edit (relinking a payment to a different invoice can log one on the original invoice) or come from a connected third-party app or a recurring transaction, so find the edit, app or recurring transaction behind it before treating it as automatic. |\n| Sage 50 without user records | Sage's page on what the audit trail tracks says the user name appears if available and otherwise shows Not Available, and Sage's printing topic recommends setting up user records in the User Security window to personalize audit trail information. |\n\nBefore naming anyone, confirm who holds each login, whether any login is shared or its password known to others, and whether an outside accountant or support person worked in the file during the window.\n\n## What if the change is older than the log or predates a conversion?\n\nFind the reachable window first: set the widest date range the view allows and note the oldest entry it returns. Intuit's audit log article says events recorded in the QuickBooks Online audit log are available for two years, and that for audit and security reasons the log can't be turned off.\n\nWhere a file was converted from QuickBooks Desktop, Intuit's audit log article says the Import Administration user shows automatic changes related to that conversion. Those entries record the move rather than who entered or changed the transactions before it, so look for earlier changes in the original file or a backup, opened as a separate copy rather than restored over the live file.\n\nWhen the event falls outside the window, the task changes from filtering the log to finding another record of the same event, such as the bank statement, the vendor's or customer's statement, a report or backup from the period, or what was filed. If prior-year figures no longer match what was filed or what your accountant had, that is its own question.\n\nZoho's FAQ and Sage's audit trail topics do not say how long history is kept or whether the trail can be switched off or purged, so in those products rely on the oldest-entry check above and treat any gap as a finding to record, not evidence that nothing happened.\n\n## How do you preserve what you found?\n\nCapture first and correct later. Every correction made during the investigation adds entries and changes the transaction's current state, burying the moment you are examining.\n\nFor each entry, the captured record should show:\n\n- The filters used and the window they covered\n- The transaction's type, number or reference, party and amount\n- The before and after values, the login and the timestamp\n- The transaction's current state in the register, or its confirmed absence\n- When you captured it and who captured it\n\nSave the filtered list and each detail view as a PDF, printout or dated screenshot. In Sage 50, Sage's printing topic offers a Preview button or Print for the Audit Trail report. Keep the copies outside the accounting file, somewhere the logins under review cannot reach.\n\nHow you proceed next depends on why you are reading the log:\n\n- **Routine review.** Record the finding in your working notes; once it passes the close test below, correct the transaction under your usual policy for edits, voids and reversals.\n- **Contested or suspected misuse.** Stop changing the affected transactions, capture everything above, and escalate before anything is corrected, re-entered or deleted.\n\n## When do you close a finding, and when do you escalate it?\n\nClose it as a routine observation only when all three of these hold:\n\n- A source document supports the transaction's current state.\n- The person behind the login confirms making the change and was entitled to make it.\n- The change does not reach into a period already reconciled, reported or filed.\n\nIf asking the login's holder would alert someone you suspect, treat the matter as contested instead.\n\nIf any of the three close conditions fails, escalate to the file owner, or, if you are the owner, to your accountant; these are the common cases:\n\n- Nobody can explain the change, or the holder of the login denies making it.\n- A payment, deposit or receipt was deleted, or an amount or payee was changed, without a supporting document.\n- The change altered figures in a period already reconciled, reported or filed.\n- The change came through a shared login and nobody can account for it.\n- The log has gaps, or the trail was switched off or purged.\n\nBefore escalating, gather the captured entries, the register trace and what you know about login practice in one place, and present them as what the log shows rather than as a conclusion about a person. Whether someone is stealing from the business is a separate question that starts from this evidence, not from the user column alone.\n\nOnce several people work in the file, a monthly run of the same filters for deletions and edits to closed periods turns the log into a standing check.",
  "sources": [
    {
      "id": "REF::1",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/use-audit-log-quickbooks-online/L2WoVnW6I_US_en_US",
      "title": "Use the audit log in QuickBooks Online",
      "publisher": "Intuit Inc.",
      "published": "last updated 8/4/2026",
      "retrieved_at": "2026-09-25T06:47:43+00:00",
      "sha256": "cd3284acd9470ccd03db08a92bd1692acc0ba9c33fc506f06f7c07fcac185452",
      "supports": [
        "C2",
        "C3",
        "C11",
        "C12",
        "C24",
        "C25",
        "C35",
        "C37",
        "C38",
        "C39",
        "C42",
        "C43",
        "C44",
        "C47",
        "C54",
        "C55",
        "C56"
      ]
    },
    {
      "id": "REF::2",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/view-transaction-changes-audit-history/L7obVhic2_US_en_US",
      "title": "View transaction changes in the audit history in QuickBooks",
      "publisher": "Intuit Inc.",
      "published": "last updated August 18, 2026",
      "retrieved_at": "2026-09-25T06:50:05+00:00",
      "sha256": "c822f6b5864d0ba46c52f70e9d0252665996caab383b0ec2903addc23ac89625",
      "supports": [
        "C4",
        "C5",
        "C13",
        "C14"
      ]
    },
    {
      "id": "REF::3",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/use-audit-log-enter-deleted-transactions/L8RHvqYB4_US_en_US",
      "title": "Use the audit log to re-enter deleted transactions in QuickBooks Online",
      "publisher": "Intuit Inc.",
      "published": "last updated 8/5/2026",
      "retrieved_at": "2026-09-25T06:52:10+00:00",
      "sha256": "7ea48ba11ba56f8099cefe6429f0dd6bca5a40b9f73d2e90f0a248d3700b1c79",
      "supports": [
        "C1",
        "C26",
        "C33",
        "C34",
        "C46",
        "C57",
        "C58"
      ]
    },
    {
      "id": "REF::4",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/list-management/void-delete-transactions-quickbooks-online/L5sZV8GYh_US_en_US",
      "title": "Void or delete transactions",
      "publisher": "Intuit Inc.",
      "published": "last updated 9/7/2026",
      "retrieved_at": "2026-09-25T06:54:32+00:00",
      "sha256": "c18dfd0a1f0bfb5f3edb5cef78326d2c691fea8110675ffd6c6267d4de7a176d",
      "supports": [
        "C30",
        "C31",
        "C32"
      ]
    },
    {
      "id": "REF::5",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/bank-registers/find-review-edit-transactions-account-registers/L2zTRtQRZ_US_en_US",
      "title": "Find, review, and edit transactions in account registers in QuickBooks Online",
      "publisher": "Intuit Inc.",
      "published": "last updated 8/4/2026",
      "retrieved_at": "2026-09-25T06:56:54+00:00",
      "sha256": "5b84b1ae968978601ad24e092204920cd3641680aba7a2853420a8cabafe4154",
      "supports": [
        "C36"
      ]
    },
    {
      "id": "REF::6",
      "url": "https://www.zoho.com/us/books/kb/reports/audit-trail.html",
      "title": "Does Zoho Books have Audit Trail? How do I view the changes that were made to a transaction?",
      "publisher": "Zoho Corporation",
      "published": "undated",
      "retrieved_at": "2026-09-25T06:57:16+00:00",
      "sha256": "6b601272c6f8b81e4413ed435188fa52e7bee2c3ad96d2cf08e7441e8bbee42a",
      "supports": [
        "C6",
        "C7",
        "C8",
        "C15",
        "C16",
        "C17",
        "C53"
      ]
    },
    {
      "id": "REF::7",
      "url": "https://help-sage50.na.sage.com/en-us/2026/Content/Reports_Forms/What_Audit_Trail_Tracks.htm",
      "title": "What Audit Trail Tracks",
      "publisher": "The Sage Group plc",
      "published": "Sage 50 U.S. help, 2026 edition",
      "retrieved_at": "2026-09-25T06:57:17+00:00",
      "sha256": "b29b250a49f80d52ccf869857151da8ff1d403b27c85772fb4c467c642ab7d98",
      "supports": [
        "C18",
        "C19",
        "C20",
        "C21",
        "C22",
        "C23",
        "C29",
        "C40",
        "C49",
        "C50",
        "C51",
        "C52"
      ]
    },
    {
      "id": "REF::8",
      "url": "https://help-sage50.na.sage.com/en-us/2026/Content/Reports_Forms/FinancialReports/Print_the_Audit_Trail_Report.htm",
      "title": "Print the Audit Trail Report",
      "publisher": "The Sage Group plc",
      "published": "Sage 50 U.S. help, 2026 edition",
      "retrieved_at": "2026-09-25T06:57:18+00:00",
      "sha256": "daa21767362f4595cf3f7c8b511f87929df22076bd5ab82b9cf37094663cc106",
      "supports": [
        "C9",
        "C10",
        "C27",
        "C28",
        "C41",
        "C45",
        "C48"
      ]
    }
  ],
  "related": [
    {
      "question_id": "CG-MCE-019",
      "slug": "should-i-edit-void-delete-or-reverse-a-transaction-that-was-recorded-wrong",
      "display_title": "Should I edit, void, delete or reverse a transaction that was recorded wrong?"
    },
    {
      "question_id": "CG-MCE-021",
      "slug": "my-prior-year-numbers-in-the-books-no-longer-match-what-was-filed-or-what-my",
      "display_title": "My prior-year numbers in the books no longer match what was filed or what my accountant had - how do I find what changed and fix it?"
    },
    {
      "question_id": "CG-MCE-022",
      "slug": "how-do-i-set-up-users-and-permissions-in-my-accounting-file-so-people-only-see",
      "display_title": "How do I set up users and permissions in my accounting file so people only see and change what they should?"
    }
  ],
  "review_class": "consequential",
  "review_class_trigger": "claim_level_review_required",
  "provenance": {
    "author_model": "claude-opus-5-5",
    "reviewer_model": "claude-opus-5-5",
    "review_verdict": "ACCEPT",
    "review_source": "closure",
    "review_verdict_on_sha256": "770d8b3d1df1a7aa37bf38c0449c8be94b0e6a434eb8f04214c65f58783bba2b",
    "editorial_disposition": "ACCEPT",
    "corrections": 1,
    "approved_by": null,
    "approved_at": null,
    "article_sha256": "770d8b3d1df1a7aa37bf38c0449c8be94b0e6a434eb8f04214c65f58783bba2b",
    "source_map_sha256": "0335f9335da22b22587149301cf860455a1728a576af90b7a4181cdbab74a42d",
    "transform_sha256": "99c7084608c4b4cb447981e59e406be9135066d90d4b8fb64460cf916794d72c"
  },
  "offer": "ask",
  "offer_id": null,
  "sample_target_id": null,
  "datePublished": "2026-09-27T05:08:58Z",
  "reviewed_at": "2026-09-27T05:08:58Z",
  "content_sha": "3add04ae8afbf6e86112d53d864f8f3965fe030a929a345965b2e833bee86dfd",
  "release": "2.10.0",
  "slug_provenance": "minted at first publication",
  "question_text": "How do I use the audit trail or change log in my accounting software to find transactions that were deleted or altered?",
  "jsonld_types": [
    "Article"
  ],
  "related_question_ids": [
    "CG-MCE-019",
    "CG-MCE-021",
    "CG-MCE-022",
    "CG-MCE-119",
    "Q-0024"
  ],
  "aliases": [],
  "alias_provenance": []
}