SayPro Audit Log Template

Section 3: Action Performed (View/Edit/Delete)

3.1 Introduction

The Action Performed section of the audit log is crucial for tracking the specific operations conducted on the data within the SayPro Data Repository. This section records the type of action carried out, whether it is a view, edit, or delete operation. Capturing these details ensures that every change or access to the data is traceable, enabling full accountability and transparency in the system. This information is vital for auditing purposes, detecting unauthorized activity, and ensuring that only authorized users make changes to the repository.

---

3.2 Information Logged

Each access event will include the following Action Performed details to accurately capture the nature of the operation conducted:

3.2.1 Action Type

• Purpose: The log will specify the type of action performed by the user on the data. This will help differentiate between passive access and active modifications to the data. The main action types include:
  • View: The user has viewed the data without making any changes.
  • Edit: The user has modified existing data or made updates.
  • Delete: The user has removed or deleted data from the repository.
  • Example Entries:
    • Action: View
    • Action: Edit
    • Action: Delete

3.2.2 Action Details

• Purpose: This field captures additional information about the specific nature of the action, especially for Edit and Delete actions. It may include details such as which fields were modified, deleted, or whether an entire record was updated or removed.
• Example Entries:
  • Edit Action Details:
    • Modified Field: Budget Amount (from $5000 to $6000)
    • Modified Record: KPI Score for Q1 (updated from 75 to 80)
  • Delete Action Details:
    • Deleted Record: Beneficiary Record #12345
    • Deleted Document: Financial Report - March 2025

3.2.3 Affected Data/Record

• Purpose: This field specifies the data or record that was affected by the action. It identifies the specific dataset, document, or record that was viewed, edited, or deleted.
• Example Entries:
  • Record ID: 12345
  • Document: Quarterly Financial Report
  • Dataset: Beneficiary Data
  • Field: Program Performance Metrics

---

3.3 Example Audit Log Entry

The Action Performed section will record each action with detailed information. Below is an example of what the log entries may look like:

Timestamp (UTC)	User Name	Action Type	Action Details	Affected Data	Purpose
2025-04-01 14:30:00 UTC	John Doe	View	No changes made	Financial Report – March 2025	Generate report for review
2025-04-01 15:00:00 UTC	Emma Smith	Edit	Modified KPI score (from 75 to 80)	Program Performance – KPIs	Update quarterly performance metrics
2025-04-01 15:30:00 UTC	John Doe	Delete	Deleted Beneficiary Record #12345	Beneficiary Record #12345	Data cleanup

In the above example:

• The Action Type column captures whether the user viewed, edited, or deleted the data.
• The Action Details column provides additional context, such as what was specifically modified (e.g., a field or record) or deleted.
• The Affected Data field indicates what part of the repository the action impacted, whether it was a specific record, dataset, or document.

---

3.4 Access Control and Security of Action Logs

3.4.1 Restriction of Log Access

Access to the audit logs detailing the actions performed will be restricted to authorized users such as system administrators or security officers. Regular users, such as program managers or data stewards, will have limited access to their own actions but will not be able to access logs of other users’ activities unless explicitly authorized.

3.4.2 Logging of Action Modifications

Any attempt to alter or tamper with the audit log entries, including changes to action types or the associated details, will be logged in a separate internal audit trail. This will help track any unauthorized attempts to modify the logs themselves, ensuring the integrity of the records.

3.4.3 Audit Log Integrity

The integrity of the audit log, including actions performed, will be safeguarded using the following methods:

• Write-once logs: Logs can only be written to, but once an entry is made, it cannot be modified or deleted without proper authorization.
• Encryption: Audit logs will be encrypted both at rest and in transit to ensure that the logs cannot be tampered with.
• Cryptographic Hashing: Each log entry may be hashed to verify its integrity, ensuring that any changes to the logs are easily detectable.

---

3.5 Retention and Archiving of Action Logs

3.5.1 Retention Period

The logs that record actions performed will be retained for at least 12 months, ensuring compliance with regulatory standards and providing an adequate history for auditing purposes. After the retention period, logs may be archived or securely deleted based on the data retention policy of the organization.

3.5.2 Archiving of Logs

After the retention period, older audit logs will be archived in a secure, off-site location for further review or analysis if necessary. These archived logs will remain encrypted and protected by the same integrity measures as active logs.

---

3.6 Conclusion

The Action Performed section of the SayPro Audit Log is vital for tracking all activities related to data access and modification. By clearly recording whether an action is a view, edit, or delete, and including additional details such as affected records or fields, this section ensures that all interactions with the SayPro Data Repository are transparent, auditable, and secure. This accountability is essential for maintaining data integrity, monitoring for unauthorized activity, and complying with regulatory requirements. The detailed logs not only help ensure the security of the system but also provide a valuable resource for auditing and responding to potential security incidents.