Every change signed, chained, replayable
Audit trail software for fund compliance must do three things: log every operationally significant event, make the log tamper-evident, and let auditors reconstruct any past state on demand. CapitalBridge implements this as a SHA-256 chained ledger covering submissions, approvals, threshold changes, covenant recalculations, status transitions, permission changes, and alert dispatches. Auditors and credit committees see full provenance in seconds, not weeks.
Q3 2025 QMA approved by alex.morgan@cygnum
sha256: 7a3f...c91e -> 2b8d...4f02
DSCR threshold 1.20x -> 1.25x by daniel.carter@cygnum
Reason: Q3 amendment; sha256: 2b8d...4f02 -> 9e1c...a8b7
DSCR 1.42x -> 1.39x (status: Compliant)
Source: Q3 QMA, period 2025-Q3; sha256: 9e1c...a8b7 -> 4f7a...d2c5
PM + credit analyst notified of covenant recalc
2 recipients, 0 errors; sha256: 4f7a...d2c5 -> b1e9...37a4
What an auditor-grade trail requires
1. Every event signed + timestamped
Who made the change, exactly when (UTC, millisecond resolution). No "Sarah changed the threshold sometime last quarter" reconstruction; every event has an actor and an exact time, recorded at the moment it happened.
2. Tamper-evident chain
Every event carries a SHA-256 hash linking back to the previous event's hash. Modify any historical event and the chain breaks; auditors can verify chain integrity in seconds. This is the property that turns an audit log into auditor-grade.
3. Before-and-after capture
"Threshold changed" is not enough. The audit log records before-and-after values for every change: DSCR threshold 1.20x -> 1.25x, headroom buffer 15% -> 10%, covenant assignment added or removed. Auditors see the delta, not just the event.
4. State-at-date reconstruction
Replay any past state. "Show me Northern Energy's covenant package on 2025-09-30 at 17:00 UTC" returns the exact thresholds, headroom buffers, and last-known covenant values as they were at that moment. Critical for credit committee post-mortems and regulator inquiries.
5. Auditor-friendly export
CSV, JSON, and PDF export of the audit log scoped to the auditor's request. Native integration with read-only auditor accounts (scoped permissions, no write access, full read of the audit trail and underlying data).
Every operationally significant event
Submission lifecycle
Submission received, validated, approved, rejected, returned for revision.
Covenant changes
Threshold change, operator change, headroom buffer change, scope change.
Covenant recalculation
New covenant value computed, status transition, source submission referenced.
Assignment changes
Reporting requirement assigned, unassigned, scope override applied.
User + permission
User created, role granted/revoked, permission scope changed.
Alert dispatch
Alert fired, recipient list, delivery success/failure, suppression decisions.
The chain, drawn
Every event carries the previous event's hash. Break one link and the chain stops verifying, so the trail is provable, not just recorded.
| Event | Actor | Hash link |
|---|---|---|
| Submission approved | credit officer | 7a3f…→2b8d… |
| Threshold changed | fund manager | 2b8d…→9e1c… |
| Covenant recalculated | system | 9e1c…→4f7a… |
Break one link, the chain shows it
Modify a historical event and its hash no longer matches the next event's link. Auditors verify the whole chain in seconds instead of trusting the log by default.
Walk me through Sahel Agri-Co's DSCR threshold change last quarter
2025-Q3 amendment, chain intact:
Illustrative figures. The assistant reads the same chained ledger an auditor would, and every call is logged to the user who made it.
Ask for the trail, get the chain
The same read-only tools that power the dashboards answer the question directly, citing the hash chain rather than a paraphrase of it.
What is audit trail software for fund compliance?+
It logs every operationally significant event (submission received, approval granted, threshold changed, covenant value updated) with the actor, the timestamp, and the before/after values. Auditor-grade goes further: events are cryptographically chained so the log is tamper-evident and any past state can be reconstructed deterministically. CapitalBridge implements this as a SHA-256 chained ledger across the full compliance workflow.
What makes a covenant audit trail auditor-grade?+
Five things: every event signed and timestamped, a tamper-evident chain (SHA-256 hash linking so events cannot be altered after the fact), before-and-after value capture rather than just "something changed," replay capability to reconstruct any past state, and export in a structured format for the auditor's own tooling. CapitalBridge implements all five as one chained ledger.
How does CapitalBridge handle audit-trail queries from external auditors?+
Permission-controlled read-only views scoped to the organisation's data, no write access, native CSV/JSON/PDF export, and a "state at date" query that reconstructs any past state of any borrower facility. The chained ledger exports as a verifiable proof artifact, so auditors can confirm nothing was altered between events.
What events are logged in the audit trail?+
Every operationally significant event: submission received, approved or rejected; covenant threshold or headroom buffer changed; covenant value recalculated; status transition (compliant to at risk to breached); reporting requirement assigned or unassigned; user permission change; alert dispatched; manual override applied. Each event carries its actor, timestamp, before/after values, and SHA-256 hash link to the previous event.