# Logging, Audit Trails and Incident Response

> An audit trail records every signal, order, change and fill so trading can be reconstructed later. Learn what to log, the regulatory rules and how it helps traders.

Source: https://learn.tradelabsai.com/algo-trading/audit-trails/  
Track: Algorithmic Trading · Level: Advanced · Updated: 2026-10-03  
Publisher: TradeLabs AI (https://tradelabsai.com). Education, not financial advice.  
Cite as: TradeLabs Learn, "Logging, Audit Trails and Incident Response", https://learn.tradelabsai.com/algo-trading/audit-trails/

An audit trail is a complete, time ordered record of everything a trading system or trader did: every market data input that mattered, every signal, every order sent, modified or cancelled, every fill and every manual intervention. It lets anyone reconstruct exactly what happened and why. For firms, audit trails are a regulatory requirement. For individual algo traders, they are the best debugging tool available and the foundation of honest performance review.

## What to record

| Event | Key fields |
|---|---|
| Signal generated | Time, strategy, symbol, signal value, inputs used |
| Order sent | Time, client order ID, symbol, side, quantity, price, order type |
| Order acknowledged | Broker or exchange order ID, time |
| Order modified or cancelled | Old and new values, reason, who or what initiated it |
| Fill | Time, price, quantity, venue, fees |
| Risk check result | Which check, pass or fail, values |
| Manual action | User, action, time, reason |
| Configuration change | Parameter, old and new value, who changed it |
| System events | Starts, stops, disconnects, errors |

## Properties of a good audit trail

| Property | Why |
|---|---|
| Complete | Gaps make reconstruction impossible |
| Time accurate | Synchronised clocks with precise timestamps. See [Clock Synchronization and PTP](https://learn.tradelabsai.com/infrastructure/clock-synchronization-and-ptp/) |
| Tamper resistant | Append only storage; records are never edited, only corrected with new entries |
| Linked | IDs connect signals to orders to fills |
| Retained | Kept for the required period |
| Searchable | Easy to query when needed |

## Regulatory requirements

- **United States:** the Consolidated Audit Trail (CAT) collects order and trade events across US equity and options markets from broker dealers. SEC and FINRA rules also require broker dealers to keep books and records, typically for several years.
- **European Union:** MiFID II requires firms to keep detailed order records and synchronise clocks to set precision levels, with stricter requirements for high frequency trading.
- **Algorithmic trading firms** in many jurisdictions must be able to explain and reconstruct algorithm behaviour on request.

See [Trading Regulators: SEC, CFTC, FINRA and NFA](https://learn.tradelabsai.com/industry/trading-regulators/).

**Example: Reconstructing a bad fill**
A trader notices a sell order filled at $97.20 when the market seemed to be near $98.50. The audit trail shows the signal fired at 14:31:02.105 using a last price of $98.48, the order was sent as a market order at 14:31:02.110, but the fill came at 14:31:04.870, almost three seconds later, during a fast drop after a news headline. The record also shows a connection warning at 14:31:02.300. The fix is clear: use marketable limit orders with a price cap, and investigate the connection delay. Without timestamps at each step, the trader could only guess.

## Audit trails for individual traders

Even without regulatory requirements, individual algo traders benefit from:

- **Debugging:** finding exactly where code behaved unexpectedly.
- **Performance analysis:** comparing intended and actual prices. See [Slippage Analysis](https://learn.tradelabsai.com/orders/slippage-analysis/).
- **Taxes and disputes:** proving trades and costs. See [Record Keeping for Traders](https://learn.tradelabsai.com/industry/record-keeping-for-traders/).
- **Honest review:** seeing every trade, not just the memorable ones. See [Trading Journal](https://learn.tradelabsai.com/start-here/trading-journal/).

## Practical implementation

1. **Write structured logs** (such as JSON lines) with consistent fields.
2. **Assign IDs** that link each signal to its orders and fills.
3. **Use UTC timestamps** with millisecond or finer precision. See [Timestamps, Time Zones and Daylight Saving](https://learn.tradelabsai.com/programming/timestamps-and-time-zones/).
4. **Store logs append only** and back them up. See [Failover, Backups and Disaster Recovery](https://learn.tradelabsai.com/algo-trading/disaster-recovery/).
5. **Reconcile daily** against broker statements. See [Trade Accounting and Reconciliation](https://learn.tradelabsai.com/industry/trade-reconciliation/).

## Frequently asked questions

### What is an audit trail in trading?

A complete, time ordered record of signals, orders, modifications, fills and manual actions that allows trading activity to be reconstructed.

### What is the Consolidated Audit Trail?

A US regulatory database that tracks orders and trades across equity and options markets, used by regulators for surveillance and investigations.

### Should retail algo traders keep audit trails?

Yes. Detailed logs make debugging, performance review and record keeping much easier, even when not legally required.

You have finished the Algo Trading track. Continue with the programming skills behind it in [Python for Trading](https://learn.tradelabsai.com/programming/python-for-trading/).

## Continue learning

- Previous lesson: [Failover, Backups and Disaster Recovery](https://learn.tradelabsai.com/algo-trading/disaster-recovery/)
- Related: [Failover, Backups and Disaster Recovery](https://learn.tradelabsai.com/algo-trading/disaster-recovery/): Power cuts, server crashes and broker outages happen. Learn how traders and trading systems plan for disasters, with backups, failover and tested recovery steps.
- Related: [Record Keeping for Traders](https://learn.tradelabsai.com/industry/record-keeping-for-traders/): Good records protect traders at tax time, in disputes and in self review. Learn what to record for every trade, how long to keep records and simple systems.
- Related: [Monitoring and Logging Systems](https://learn.tradelabsai.com/infrastructure/monitoring-and-logging-systems/): The tools behind trading observability: structured logs, metrics, dashboards, tracing and alerting with Prometheus, Grafana and log stacks, and how to set them up.
- Related: [Trade Accounting and Reconciliation](https://learn.tradelabsai.com/industry/trade-reconciliation/): Reconciliation checks that internal records of trades, positions and cash match brokers, custodians and clearing houses. Learn the process, common breaks and fixes.
- Related: [Trading Regulators: SEC, CFTC, FINRA and NFA](https://learn.tradelabsai.com/industry/trading-regulators/): Who regulates trading and markets: the SEC, CFTC, FINRA and NFA in the US, the FCA in the UK and ESMA in the EU. Learn what each one oversees and why it matters.
- Related: [Trading Journal](https://learn.tradelabsai.com/start-here/trading-journal/): A trading journal records every trade so you can find what works and what keeps costing you. Learn what to log, a template and how to review it.