Use the audit log in QuickBooks Online

Learn what the audit log can do and how to use it to keep an audit trail.

With QuickBooks Online Advanced, you can create your own reports using Custom Report Builder.

QuickBooks Online tracks not only financial transactions but all account activities in the audit log. This includes user sign-ins, changes to QuickBooks settings, edits to customers, vendors, employees, and payroll submission. If you need to find a deleted transaction, such as a deleted invoice, search the log to find the specific record. 

The audit log provides a detailed trail of who made changes and what actions they performed to help you manage your books.

Events recorded in the audit log are available for two years.

Note: Sign-outs are only recorded in the audit log when you select Sign out. Sign-outs aren’t recorded if you close your browser, go to another website, or when QuickBooks signs you out automatically due to inactivity.

For a better experience, open this article in QuickBooks Online. Launch side-by-side view

What you’ll need

• An active QuickBooks Online subscription.
• Admin access. If you can't see the audit log, contact your primary admin to get access.

Events recorded in the audit log are available for two years.

Find a deleted invoice or activity

If you are looking for how to find a deleted invoice or review invoice activities in QuickBooks Online, follow the steps below:

1. Go to Settings and select Audit log.
2. Select Filter.
3. Use the fields on the Filter panel to choose the appropriate User, Date, or Events filter to narrow the results.
4. Select Apply.
5. Locate the transaction or event in the results, which show 150 records at a time.
6. Select View in the History column to open the audit history for that specific transaction.

Note: For audit and security reasons, you can't turn off the audit log.

Review QuickBooks user profiles

QuickBooks automatically creates specific user profiles to track certain actions in the audit log. If you see a user you don't recognize, it’s most likely one of these:

• Online Banking Administration: Shows a change related to your connected bank accounts made automatically by QuickBooks Online.
• Support Representative: Shows changes made by a QuickBooks Online support consultant.
• System Administration: Shows changes made automatically by QuickBooks Online. This can happen for a number of reasons, such as:
  • You change a record, and the change affects another record. For example, if you edit a payment and link it to a different invoice, you may see a System Administration event for a change to the original invoice.
  • You connect a third-party app to QuickBooks. When the third-party app sends data to QuickBooks, or when it makes a change to your existing data, this appears as a System Administration event.
  • You create a recurring transaction, such as a recurring expense. When QuickBooks automatically adds an instance of the transaction to your books, a System Administration event appears in the audit log.
  • You set up other events to happen automatically, even when you’re not signed in. For example, a System Administration event may appear when there's an update to your bank feeds.

• Import Administration: Shows an automatic change related to the conversion of your data from QuickBooks Desktop edition.

Results

The audit log displays the date of the change, the user who made it, and any original transaction details. This history remains available for 2 years. Note that sign-outs are only recorded when you manually select Sign out, not when you close your browser or time out due to inactivity.

Next steps

Review any "indirect edits" in the history, which occur when someone modifies a transaction already on your books, such as an edited reconciliation. 

• User roles and access rights
• Create recurring invoices and other transactions in QuickBooks Online