Skip to main content

Audit Trail and Activity Log

Published: Last updated: Reviewed: Sources: ecfr.gov gao.gov aicpa-cima.com ecfr.gov

TLDR

The activity log records every create, update, and delete across donors, grants, funds, and allocations with the acting user, a timestamp, and a JSONB diff of before and after values. Records retain for the full federal requirement under 2 CFR 200.334 (three years after grant closeout), and an auditor-ready CSV export rebuilds the trail for any entity or period.

The activity log records every create, update, and delete across donors, grants, funds, and allocations with the acting user, a timestamp, and a JSONB diff of before and after values. Records retain for the full federal requirement under 2 CFR 200.334 (three years after grant closeout), and an auditor-ready CSV export rebuilds the trail for any entity or period.

TL;DR

  • Polymorphic activity log covers every mutable entity
  • JSONB diff captures the full before and after state per changed field
  • Append-only; no UI or API path to modify entries
  • Retention default meets 2 CFR 200.334 federal records requirement
  • CSV export filters by entity, date range, user, or grant for audit evidence

What this feature does

The activity log is the compliance record every nonprofit that accepts federal funds needs and most do not actually have. When an auditor samples ten grant expenditures and asks for the approval chain, the organization either produces it or accepts a finding. GrantPipe captures the chain automatically: every time a record changes, the log records who changed it, when, and exactly what changed. The export turns that into the evidence packet an auditor expects.

How it works

  1. Every write through the API emits an activity entry via middleware
  2. The entry carries entity type, entity ID, action (create, update, soft-delete, restore), user, and UTC timestamp
  3. For updates, a JSONB diff captures changed fields with before and after values
  4. Soft-delete and restore are logged as explicit actions, not side-effects
  5. Entries are append-only; there is no mutation path
  6. Exports filter by entity, user, grant, date range, or action type; output is CSV with JSON diff column

Who it’s for

Finance leads responding to the annual single audit under OMB Uniform Guidance. Executive directors fielding a funder compliance review. Board treasurers answering questions about who approved a transfer between restrictions. IT and compliance staff answering SOC 2 or data-handling questionnaires from major funders.

Why GrantPipe built it this way

Activity logging is often implemented as a per-entity audit table maintained by application code. That approach works until a new entity is added and the logging code is forgotten. The architectural decision was to make the log a middleware concern, not an application concern. Every write through the API passes through the same interceptor, so adding a new entity does not require remembering to add audit logging. The polymorphic shape (entity_type plus entity_id) means one table, not one per entity, which keeps exports simple. JSONB for the diff means the schema never has to change when a column is added, and the auditor sees the full shape of the change without joins.

What it replaces

  • The per-record “last modified by” field that does not tell you what changed
  • The ad-hoc spreadsheet of approvals the grants manager maintains for audit season
  • The screenshot-of-the-email approval evidence packet
  • The audit finding on weak documentation of changes to grant obligations
  • The manual reconstruction of who approved a restriction reallocation six months ago

Start a free trial

Start a trial.

Free resource

Get the Nonprofit CRM Evaluation Scorecard

A weighted scoring framework for comparing nonprofit CRMs across the 8 categories that matter most to mid-sized organizations: donor management, grant tracking, reporting, integrations, and total cost. Delivered by email.

Email is required for delivery. We'll send the resource to your inbox.

Email is required because the download link is delivered by email, not on-page.

2 CFR 200.334 requires federal grantees to retain financial records for three years after the final expenditure report is submitted

Source: 2 CFR 200.334 Retention Requirements for Records

GAO's 2024 High Risk Series identifies weak grantee documentation as a recurring finding in federal grant audits

Source: U.S. GAO 2024 High Risk Series

AICPA Statement on Auditing Standards 145 requires auditors to evaluate the design and implementation of IT general controls including change logging

Source: AICPA SAS No. 145

Q&A

What is 2 CFR 200.334?

The federal records retention rule for grantees under the Uniform Guidance. Financial records, supporting documents, and statistical records must be retained for three years from the date of submission of the final expenditure report, with exceptions for litigation and audit extension.

Q&A

How does the log help during an audit?

An auditor testing a sample of grant expenditures will ask who approved the allocation, when, and what it looked like before the change. The log answers all three questions as a CSV row with a JSON diff, produced in minutes.

Q&A

Can activity entries be edited or deleted?

No. The log is append-only. There is no user interface or API path to modify an activity entry. This is intentional and tested as part of the security review.

Q&A

Does the log show org-level isolation?

Yes. Every entry carries the organization ID and is scoped by the same row-level multi-tenancy middleware used by the rest of the system. Cross-org leakage is prevented at the query layer, not at the UI.

Frequently asked

Frequently Asked Questions

What is captured in the activity log?
Every create, update, and delete on any main entity (contacts, donations, pledges, grants, funds, allocations, reports). Each entry records the entity type and ID, the acting user, the timestamp in UTC, and a JSONB diff of changed fields with before and after values.
How long are activity records retained?
Indefinitely by default. Organizations with data residency or deletion obligations can configure retention, but the default is set to meet 2 CFR 200.334, which requires records for three years after grant closeout.
Can I export the log for an audit?
Yes. Exports filter by entity, date range, user, or grant. Output is CSV with one row per change and the full diff in a JSON column. Auditors can open it in Excel or a JSON tool, no special software required.
Does it capture read access as well?
No. The activity log captures mutations only. Read-access logging is on the roadmap and is typically required only for HIPAA-adjacent or PII-sensitive workflows.
What about deletions?
GrantPipe uses soft delete by default: deletions set a deleted_at timestamp rather than removing the row. The activity log records who soft-deleted and when; the underlying record remains available for audit retrieval.