T 2.73 Inadequate audit trail of archive systems

The audit of an archiving procedure must take into consideration both organisational and technical criteria. Therefore, the audit of the archive systems must also include a verification of the assignment and use of data access rights, along with the review of the system configuration.

If the selected archive system does not provide the required technical support in this connection, e.g. in the form of specific user accounts for auditing, monitoring tools, integrity-protected log files (see T 2.76 Inadequate documentation of archive accesses), the audit procedure may become very complex. Furthermore, this entails the risk that the procedure is performed only incompletely and essential items are disregarded. The audit procedure of the archiving process may be jeopardised as a whole.

Indirectly, this may result in legal and economic disadvantages, e.g. through the lapse of validity of archived documents.