ERP Audit Trails and Logging: What to Capture and Keep
An ERP audit trail is a tamper-resistant record of who changed what data, when, and from where, retained long enough to support investigation and compliance testing. Manufacturers need it for three separate reasons: financial auditors testing IT general controls, security teams investigating incidents, and defense customers requiring NIST SP 800-171 audit and accountability controls. Most ERP systems log far less by default than people assume, and native logging is usually optimized for troubleshooting rather than for evidence. This guide covers what to log, how to capture it in Infor systems, retention, and how to make it hold up.
What Must Be Logged in an ERP System
Log at the level of business risk, not at the level of everything, because logging every field change in a busy ERP produces terabytes nobody reads. The essential categories are authentication events, privilege and role changes, master data changes with financial impact, transaction overrides, and administrative actions on the logging system itself. Vendor bank account changes deserve their own alert rather than a log entry, because that is the direct fraud path. Also log data exports and large report runs, since exfiltration in an ERP looks like a legitimate query. Aim for coverage of these categories before you widen scope to routine transactional data.
- Authentication: successful and failed logins, lockouts, source IP, and session start and end times
- Authorization: role, group, and object permission grants, revocations, and any use of a break-glass account
- Master data: vendor bank details, customer credit limits, item cost and price, and payment terms changes
- Transaction overrides: credit hold release, price override, inventory adjustment, and posting period reopening
Capturing Audit Data in SyteLine and Infor LN
SyteLine and CloudSuite Industrial provide object-level auditing that records before and after values for the tables and columns you enable, written to audit tables you can query and report on. Enable it selectively for high-risk tables rather than globally, because indiscriminate auditing degrades transaction performance and floods storage. Infor LN offers audit management under Tools that captures changes at the table level with similar selectivity. Underneath either, SQL Server temporal tables or change data capture can supplement application auditing for tables the ERP does not cover. Always audit the audit configuration itself so a privileged user cannot silently disable capture.
Retention, Storage, and Framework Requirements
Retention is driven by whichever obligation is longest. NIST SP 800-171 and CMMC Level 2 expect audit records sufficient to support after-the-fact investigation, which in practice means at least twelve months and often longer for defense work. Financial audit generally expects the current year plus prior year available for testing, while some contracts and statutes push financial records to seven years. Keep roughly 90 days hot and searchable in the ERP or SIEM, the balance of twelve months warm, and older data in cheap immutable archive. Budget for volume: a mid-size manufacturer commonly generates 5 to 30 GB of security-relevant ERP log data per year.
- Keep 90 days immediately searchable, twelve months warm, and the remaining retention in immutable archive
- Write logs to storage where ERP administrators cannot delete or edit them, ideally a separate account and tenant
- Synchronize all servers to a common time source so events correlate across ERP, database, and network layers
- Test retrieval annually by answering a realistic investigation question from archive within one business day
Turning Logs Into Detection and Audit Evidence
A log nobody reviews is a storage bill, not a control. Forward ERP events to a SIEM such as Microsoft Sentinel, Splunk, or Elastic and build a small number of high-value detections rather than hundreds of noisy rules. Useful ERP detections include a single user granting themselves a role, a vendor bank change followed by a payment run within 48 hours, logins from a country you do not operate in, and a bulk export outside business hours. For auditors, prepare standing reports that answer the questions they always ask so evidence generation takes ten minutes instead of a week of ad hoc queries.
How Netray Builds ERP Logging That Auditors Trust
Netray designs the audit configuration for your Infor environment, enabling capture on the tables that matter without the performance penalty of blanket auditing. Our AI agents normalize SyteLine, LN, and M3 audit output into a common event schema, forward it to your SIEM, and run continuous detections for the fraud and misuse patterns specific to ERP rather than generic IT alerts. The same pipeline generates the recurring evidence packages your financial and CMMC assessors request. Clients typically move from ad hoc log pulls taking several days per request to standing reports produced on demand in minutes.
Frequently Asked Questions
What should be included in an ERP audit trail?
At minimum, capture authentication events including failures, all changes to roles and permissions, changes to financially sensitive master data such as vendor bank details and customer credit limits, transaction overrides like price changes and credit hold releases, and administrative actions on the logging configuration itself. Each record should show the user, timestamp, source, and both the previous and new values so a reviewer can reconstruct exactly what changed.
How long should ERP audit logs be retained?
Plan for at least twelve months of retrievable audit data as a baseline, which satisfies most security frameworks including NIST SP 800-171 expectations. Financial and contractual obligations often extend records to seven years. A practical tiering is 90 days immediately searchable, twelve months warm, and the remainder in low-cost immutable archive. Confirm the specific retention requirement in your customer contracts before setting the policy.
Does enabling ERP auditing slow down the system?
Blanket auditing does, because every insert and update writes additional rows and the audit tables grow quickly on high-volume transactional data. Selective auditing on high-risk master data and permission tables has minimal measurable impact. Enable it in a test environment first, measure transaction times on your heaviest processes such as MRP and order entry, and archive audit tables on a schedule so query performance stays stable.
Key Takeaways
- 1What Must Be Logged in an ERP System: Log at the level of business risk, not at the level of everything, because logging every field change in a busy ERP produces terabytes nobody reads. The essential categories are authentication events, privilege and role changes, master data changes with financial impact, transaction overrides, and administrative actions on the logging system itself.
- 2Capturing Audit Data in SyteLine and Infor LN: SyteLine and CloudSuite Industrial provide object-level auditing that records before and after values for the tables and columns you enable, written to audit tables you can query and report on. Enable it selectively for high-risk tables rather than globally, because indiscriminate auditing degrades transaction performance and floods storage.
- 3Retention, Storage, and Framework Requirements: Retention is driven by whichever obligation is longest. NIST SP 800-171 and CMMC Level 2 expect audit records sufficient to support after-the-fact investigation, which in practice means at least twelve months and often longer for defense work.
Put this into numbers
Free interactive tools for exactly this problem. No signup to use them.
ERP License Audit Risk Assessment
Answer 10 questions about your license tracking, indirect access, and contract hygiene to see how exposed you would be in a vendor license audit.
Free ToolDCAA Accounting Compliance Readiness Assessment
Score your accounting system against the SF 1408 preaward survey criteria and DCAA audit expectations across timekeeping, job costing, and indirect rates.
Free ToolERP Security Posture Checklist
Work through 30 concrete security controls across access, patching, network, data protection, and monitoring, with the highest-risk items flagged.
Terms used in this article
Design ERP audit trails that detect real fraud patterns and produce assessor-ready evidence without drowning your team in noise.
Related Resources
ERP Security Best Practices for Manufacturers
ERP security best practices for manufacturers: harden Infor SyteLine and LN with least privilege, MFA, patching, encryption, and audit-ready access controls.
ERPSegregation of Duties in ERP Systems
A practical segregation of duties guide for ERP: build an SoD conflict matrix, test SyteLine and Infor LN roles, and document mitigating controls for auditors.
ERPERP User Access Reviews That Pass Audit
How to run ERP user access reviews that pass audit: extract entitlements, choose reviewers, evidence decisions, and close revocations on a defensible timeline.