# Reconstruct a week from the audit log

> **What you will learn**
> Not a chapter to read but one to **do**. Using only last week's log, **answer
> four questions.** Whatever you cannot answer is your current blind spot.

## What you need

```
□ 30 minutes
□ Admin rights (only admins see the audit log)
□ A workspace with at least a few days of activity
□ A sheet of paper
```

**You can do this alone.** But find the answers **in the log only.** Answer from
memory and the exercise teaches you nothing.

---

## Step 1 — Write the four questions first (5 min)

These are the questions [the audit log](/guide/cn-audit) has to answer. Write
them **before you open it.**

```
□ Did anyone change a tool setting last week? Who, and what?
□ Did any new members join? Who invited them?
□ How many actions went outside (sends, posts)?
□ Which tool was used most last week?
```

**Why write them first**: open the log first and you will shape your questions
around **what is in it**, which hides the blind spots entirely.

---

## Step 2 — Answer from the log alone (15 min)

| Question | Answer found in the log | Minutes taken | Confident? |
|---|---|---|---|
| 1 setting changes | | | □ |
| 2 member invites | | | □ |
| 3 actions going outside | | | □ |
| 4 most-used tool | | | □ |

```
Rules:
  □ Do not top it up from memory
  □ If you cannot find it in five minutes, write "not found"
```

### What comes out of this

**All four inside five minutes** — this is working. Go to step 3.

**One or two not found** — the common case. Separate whether it was **not
recorded** or you **did not know where to look.** Those are entirely different
problems.

**More than half not found** — it means you could not answer during an incident.
That is what step 3 is for.

---

## Step 3 — Write down the blind spots (10 min)

For each question you could not answer, write the cause.

| Question missed | Not recorded, or did not know where? | How to close it |
|---|---|---|
| | | |

```
Not recorded      -> decide what else to keep; if you cannot, write that fact down
Did not know how  -> leave a one-line note so the next person finds it in five minutes
```

**The second is most of them.** And it takes thirty minutes to fix — four lines
saying "for this question, look at this screen, like this."

### What the log cannot give you

[The audit log](/guide/cn-audit) records **what happened**, not **why.** So the
last line of this exercise is this.

```
□ Where do you record the judgement calls that never reach the log
  (why that tool was enabled)?
```

If that is blank, it is the document you make next.

---

## Self-check

```
□ You wrote the four questions before opening the log
□ You did not top up from memory
□ You classified each miss as "not recorded" or "did not know where"
□ You left at least one line of guidance for the next person
```

---

## Check yourself

**1. Why write the questions before opening the log?**

<details>
<summary>Answer</summary>

**Because looking first makes you shape questions around what is there.** The
records that are missing — the blind spots — then never become visible.
</details>

**2. Why separate "not recorded" from "did not know where to look"?**

<details>
<summary>Answer</summary>

**The remedies are completely different.** The first needs a decision about what
else to keep; the second needs one line of guidance. The second is far more common
and far cheaper.
</details>

**3. What can an audit log not answer?**

<details>
<summary>Answer</summary>

**Why it was done.** The log records what happened, not the reasoning behind it,
so the rationale for a settings change has to be written down somewhere else.
</details>

---

Next, signing in with your company account → [SSO and department sync](/guide/cn-sso)