# Assessment Audit Log and Reporting

*Audience: Admins and auditors*

This guide covers what the Assessment Audit Log captures, how to view and export it, and how completion notifications and template change tracking round out reporting on an assessment's history.

## What gets captured

The Assessment Audit Log gives you a complete, timestamped history of every change made within an assessment. Every edit - question updates and answer changes, section restructuring, status transitions - is recorded with the user responsible. For edits to an existing value, the log stores both the **before** and **after** state.

The log is available on all assessments by default; no configuration is required to enable it.

## Accessing the audit log

Open any assessment and click the **Audit Logs** tab, alongside **Overview** and **Tasks**. The log loads with the most recent activity at the top. Use the **Search** field to filter entries by keyword, click the **Date & Time** column header to reverse the sort order, or click the refresh icon to reload without leaving the page.

## Reading the activity list

The audit log displays three columns:

| Column | What it shows |
|---|---|
| **Activity** | The type of change and the item affected (for example, "Question Name Updated - 1.1 Yes test") |
| **User** | The initials of the user who made the change |
| **Date & Time** | Timestamp of the change, sortable descending by default |

Activity types you may see include:

- **Answer Added / Answer Changed** - a question answer was submitted or edited
- **Matrix Answer Updated** - one or more cells in a matrix question were changed
- **Status Updated** - the assessment status changed (for example, In Progress → In Review)
- **Question Name Updated / Question Created** - a template question was renamed or added
- **Question Name, Description, Required, Hidden Updated** - multiple question properties changed in one save
- **Section Created / Section Deleted / Section Cloned / Sections Reordered** - structural changes to the assessment template

Entries marked with a **›** chevron expand to reveal the before and after values for each changed field. For matrix question changes, each modified cell is shown individually, identified by its row and column labels.

## Exporting the audit log

Click the download icon in the top-right of the Audit Logs tab to open the export dialog and choose a format:

| Format | Best for |
|---|---|
| **Single PDF** | Auditor-formatted single-document export, ready to attach to an audit response |
| **CSV** | Raw tabular data for analysis in spreadsheets or import into GRC tools |

A toast notification confirms when the export is ready, with a download button and an auto-generated filename (for example, `audit-log_OpenAI_2026-06-10_18-26-11.csv`).

## Template change history

Separately from the question/answer audit trail, assessments record when the template they were built from has since been updated - so you can see the history of template changes applied against a specific assessment, distinct from changes made to the assessment's own answers.

## Notifications: staying ahead of drift

Once an assessment is marked complete, assessment notifications - including drift alerts triggered when the underlying data map changes after completion - are available to all customers. This is the signal that closes the gap between "we assessed this once" and "we know when to look again": a completed DPIA or vendor assessment doesn't go stale silently the moment the processing activity or vendor relationship it covered changes.

## Assessments dashboard

For a higher-level view than a single assessment's audit log, the Assessments dashboard reports across every assessment at once, and every figure on it is clickable through to the records it counts - useful for a standing compliance review rather than auditing one assessment at a time. Reporting breaks down into two kinds of data:

- **Volume** - how many assessments were created and how many were completed, broken out by month, so you can see whether intake is outpacing completion.
- **Completion time and SLA attainment** - median and 90th-percentile (p90) days from creation to completion, both for the window you're looking at overall and broken out month by month, plus an SLA attainment percentage - the share of assessments that closed within whatever SLA target is configured for their type. This is what backs the dashboard's SLA settings and status-history view: the same underlying metric (creation-to-completion cycle time) is what an SLA target is measured against.

Both views respect a date range, so you can report on a specific quarter or month rather than only all-time totals.

> **Note.** This same metrics data - monthly created/completed counts, median/p90 completion time, and SLA attainment - is also available through the Privacy API itself, alongside an endpoint that lists assessments with their status, template/type, and created/completed timestamps. See the [Technical Implementation Guide](/docs/assessments/technical-implementation-guide/#assessment-listing-reporting-api) or the [API Reference](/docs/api-reference/#privacy/tag/assessment-listing-reporting) directly.

## Access requirements

Any user with access to the assessment can view the Audit Logs tab. Export permissions follow the same access rules.

## FAQs / edge cases

**Are answer changes by external respondents also tracked?**
Yes - all answer submissions and edits are logged regardless of whether the change was made by an internal user or an external respondent completing the assessment.

**How far back does the audit log go?**
The audit log captures all changes from the point the feature was enabled for your account forward. Changes made before enablement are not retroactively logged.

**Does the audit log capture automated changes, like auto-save?**
The log records the saved state of changes. Intermediate auto-save drafts that were never committed do not generate entries.

**Can I filter the audit log by user or date range?**
Currently the log can be searched by keyword and sorted by date. User and date-range filtering are not yet available.

## Related reading

- [Legal and Compliance Guide](/docs/assessments/legal-and-compliance-guide/) - why this audit trail matters for GDPR Article 35 and ISO 27701 posture
- [Admin Configuration Guide](/docs/assessments/admin-configuration-guide/#completing-assessments) - configuring completion prerequisites and notifications
- [FAQ: Assessments](/docs/assessments/faq-assessments/) - common questions from prospects and new customers