Assessment Audit Log and Reporting

Audience: Admins and auditors

This guide covers what the Assessment Audit Log captures, how to view and export it, and how completion notifications and template change tracking round out reporting on an assessment's history.

#What gets captured

The Assessment Audit Log gives you a complete, timestamped history of every change made within an assessment. Every edit - question updates and answer changes, section restructuring, status transitions - is recorded with the user responsible. For edits to an existing value, the log stores both the before and after state.

The log is available on all assessments by default; no configuration is required to enable it.

#Accessing the audit log

Open any assessment and click the Audit Logs tab, alongside Overview and Tasks. The log loads with the most recent activity at the top. Use the Search field to filter entries by keyword, click the Date & Time column header to reverse the sort order, or click the refresh icon to reload without leaving the page.

#Reading the activity list

The audit log displays three columns:

Activity types you may see include:

• Answer Added / Answer Changed - a question answer was submitted or edited
• Matrix Answer Updated - one or more cells in a matrix question were changed
• Status Updated - the assessment status changed (for example, In Progress → In Review)
• Question Name Updated / Question Created - a template question was renamed or added
• Question Name, Description, Required, Hidden Updated - multiple question properties changed in one save
• Section Created / Section Deleted / Section Cloned / Sections Reordered - structural changes to the assessment template

Entries marked with a › chevron expand to reveal the before and after values for each changed field. For matrix question changes, each modified cell is shown individually, identified by its row and column labels.

#Exporting the audit log

Click the download icon in the top-right of the Audit Logs tab to open the export dialog and choose a format:

A toast notification confirms when the export is ready, with a download button and an auto-generated filename (for example, audit-log_OpenAI_2026-06-10_18-26-11.csv).

#Template change history

Separately from the question/answer audit trail, assessments record when the template they were built from has since been updated - so you can see the history of template changes applied against a specific assessment, distinct from changes made to the assessment's own answers.

#Notifications: staying ahead of drift

Once an assessment is marked complete, assessment notifications - including drift alerts triggered when the underlying data map changes after completion - are available to all customers. This is the signal that closes the gap between "we assessed this once" and "we know when to look again": a completed DPIA or vendor assessment doesn't go stale silently the moment the processing activity or vendor relationship it covered changes.

#Assessments dashboard

For a higher-level view than a single assessment's audit log, the Assessments dashboard reports across every assessment at once, and every figure on it is clickable through to the records it counts - useful for a standing compliance review rather than auditing one assessment at a time. Reporting breaks down into two kinds of data:

• Volume - how many assessments were created and how many were completed, broken out by month, so you can see whether intake is outpacing completion.
• Completion time and SLA attainment - median and 90th-percentile (p90) days from creation to completion, both for the window you're looking at overall and broken out month by month, plus an SLA attainment percentage - the share of assessments that closed within whatever SLA target is configured for their type. This is what backs the dashboard's SLA settings and status-history view: the same underlying metric (creation-to-completion cycle time) is what an SLA target is measured against.

Both views respect a date range, so you can report on a specific quarter or month rather than only all-time totals.

Note. This same metrics data - monthly created/completed counts, median/p90 completion time, and SLA attainment - is also available through the Privacy API itself, alongside an endpoint that lists assessments with their status, template/type, and created/completed timestamps. See the Technical Implementation Guide or the API Reference directly.

#Access requirements

Any user with access to the assessment can view the Audit Logs tab. Export permissions follow the same access rules.

#FAQs / edge cases

Are answer changes by external respondents also tracked? Yes - all answer submissions and edits are logged regardless of whether the change was made by an internal user or an external respondent completing the assessment.

How far back does the audit log go? The audit log captures all changes from the point the feature was enabled for your account forward. Changes made before enablement are not retroactively logged.

Does the audit log capture automated changes, like auto-save? The log records the saved state of changes. Intermediate auto-save drafts that were never committed do not generate entries.

Can I filter the audit log by user or date range? Currently the log can be searched by keyword and sorted by date. User and date-range filtering are not yet available.

#Related reading

• Legal and Compliance Guide - why this audit trail matters for GDPR Article 35 and ISO 27701 posture
• Admin Configuration Guide - configuring completion prerequisites and notifications
• FAQ: Assessments - common questions from prospects and new customers