Reconstruct a week from the audit log

What you will learn Not a chapter to read but one to do. Using only last week's log, answer four questions. Whatever you cannot answer is your current blind spot.

What you need

text

□ 30 minutes□ Admin rights (only admins see the audit log)□ A workspace with at least a few days of activity□ A sheet of paper

You can do this alone. But find the answers in the log only. Answer from memory and the exercise teaches you nothing.

Step 1 — Write the four questions first (5 min)

These are the questions the audit log has to answer. Write them before you open it.

text

□ Did anyone change a tool setting last week? Who, and what?□ Did any new members join? Who invited them?□ How many actions went outside (sends, posts)?□ Which tool was used most last week?

Why write them first: open the log first and you will shape your questions around what is in it, which hides the blind spots entirely.

Step 2 — Answer from the log alone (15 min)

Question	Answer found in the log	Minutes taken	Confident?
1 setting changes			□
2 member invites			□
3 actions going outside			□
4 most-used tool			□

text

Rules:  □ Do not top it up from memory  □ If you cannot find it in five minutes, write "not found"

What comes out of this

All four inside five minutes — this is working. Go to step 3.

One or two not found — the common case. Separate whether it was not recorded or you did not know where to look. Those are entirely different problems.

More than half not found — it means you could not answer during an incident. That is what step 3 is for.

Step 3 — Write down the blind spots (10 min)

For each question you could not answer, write the cause.

Question missed	Not recorded, or did not know where?	How to close it

text

Not recorded      -> decide what else to keep; if you cannot, write that fact downDid not know how  -> leave a one-line note so the next person finds it in five minutes

The second is most of them. And it takes thirty minutes to fix — four lines saying "for this question, look at this screen, like this."

What the log cannot give you

The audit log records what happened, not why. So the last line of this exercise is this.

text

□ Where do you record the judgement calls that never reach the log  (why that tool was enabled)?

If that is blank, it is the document you make next.

Self-check

text

□ You wrote the four questions before opening the log□ You did not top up from memory□ You classified each miss as "not recorded" or "did not know where"□ You left at least one line of guidance for the next person

Check yourself

1. Why write the questions before opening the log?

Answer

Because looking first makes you shape questions around what is there. The records that are missing — the blind spots — then never become visible.

2. Why separate "not recorded" from "did not know where to look"?

Answer

The remedies are completely different. The first needs a decision about what else to keep; the second needs one line of guidance. The second is far more common and far cheaper.

3. What can an audit log not answer?

Answer

Why it was done. The log records what happened, not the reasoning behind it, so the rationale for a settings change has to be written down somewhere else.

Next, signing in with your company account → SSO and department sync