Audit Logs: The Questions Every Auditor Should Be Able to Answer About Your Property Business

There is a persistent assumption that audit questions are about catching someone doing something wrong. Occasionally that is true. Usually it is not.

An auditor's actual job is to form an opinion. To do that, they sample transactions and ask whether the controls around them are designed properly and operating consistently. If the answer is we did not record that, the conclusion is not that fraud occurred. The conclusion is that the control environment cannot be relied upon, which for a growing business is a more expensive problem than any individual irregularity.

1. Who created this record, and when?

The most basic question, and the one most record-keeping fails. A subscriber record, an invoice, a payment entry, a plot allocation. If you cannot say who created it and when, you cannot say whether it is authentic.

2. Who approved it, and under what limit?

A voucher worth two hundred thousand naira and a voucher worth two million should not travel the same path. Auditors ask about approval thresholds constantly. A business that approves everything at one level has a control it does not have.

3. Can the preparer approve their own work?

Segregation of duties is the oldest idea in accounting, and the most commonly violated in small and mid-sized firms, often with excellent intentions. If the person who raises a payment also approves it, an error is invisible and a mistake is indistinguishable from an abuse.

4. What changed, and what is the previous value?

Not just the current state. The change history. When a plot moved from available to allocated, when a balance was adjusted, when a subscriber's status moved to inactive. Businesses that keep only current values cannot investigate anything, because there is no timeline.

5. Show me the money trail for this transaction.

From the invoice, to the payment, to the receipt, to the bank, to the ledger. Not three of those five. All five, linked, for one specific transaction the auditor chooses. This is usually where hand-kept systems fail first.

6. Who had access to this record, and who actually opened it?

Two different questions. Role design is the first. Usage is the second. Access logs matter when there is a dispute about who looked at a subscriber's file, and they matter more when there is an allegation of privacy misuse.

7. Can you produce this for a date two years ago?

The retention question. Not for yesterday. Two years ago. If your answer involves finding a backup drive or asking whether the person who did it still works there, the answer is no.

8. Where are the exceptions, and who approved the override?

Every system has exceptions. Discounts beyond policy, price list overrides, manual journal entries, waived fees. A business that reports only standard operations is hiding the part an auditor cares most about.

9. Who reconciled the bank, and when?

Reconciliation is a control with a name, a date and a signature. If the answer is finance did it sometime in the month, that is a finding, because unreconciled accounts are where errors and irregularities both live.

You do not need a hundred controls. Most property businesses need four, done consistently.

Here is a small worked example of how this feels. A property company sells plot 14 in Block C. Eighteen months later, a due diligence exercise asks for the file.

What is needed: the subscriber record and its creation date, the allocation record and its date, the price used, the invoice, the payment records and receipts, the allocation letter, any adjustment to the balance, the approver for any adjustment, and any changes to the plot's status over the period.

What is usually available: a WhatsApp message confirming the payment, a signature on an allocation letter, a name in a register, and a bank statement showing a transfer with no reference.

Nobody in that business did anything wrong. The transaction was genuine, the buyer is happy, the plot is properly allocated. The business simply cannot prove the sequence, so the reviewer discounts the whole file rather than the one item that is missing.

1. Pull one file end to end for a transaction that closed two years ago. Time it. That number is your baseline.

2. Check whether one person can both raise and approve a payment. If yes, that is your first fix and it costs nothing.

3. Confirm your bank reconciliation is dated and named for every account, every period. If it is a habit rather than a record, make it a record.

4. Ask for a list of manual adjustments in the last six months. If producing it takes more than a day, that is the gap.

5. Decide who owns exceptions. One named person reviewing out-of-policy actions monthly, with the review itself written down.

An audit log records what happened inside the system. It cannot prove what happened outside it, and it cannot tell you whether a recorded transaction was itself justified at the time. It is evidence, not proof, and no vendor should claim otherwise.

What it does is put a timestamp and a name against the decisions that a business actually makes, every day, in a form that survives staff turnover and memory loss. For a sector where the largest asset is usually land on paper, that is not a compliance feature. It is the difference between a claim and a record.