What Is the Xero Audit Trail?

Xero’s audit trail is a permanent, tamper-proof record of every change made in your account. It logs who did what, when they did it, and what the values were before and after the change. For UK businesses, this matters for HMRC compliance, statutory audits, and internal financial controls.

Unlike paper records where entries can be altered or lost, Xero’s digital audit trail is always complete and cannot be edited or deleted by any user – including administrators.

What Does the Xero Audit Trail Record?

Every action in Xero is logged. The audit trail captures:

  • Transaction creation – when an invoice, bill, payment, or journal entry was created, and by whom
  • Edits and amendments – any edit to amounts, dates, account codes, or descriptions, with both the old and new values
  • Deletions – what was deleted, when, and by which user
  • Bank reconciliation – when transactions were matched, unmatched, or modified during reconciliation
  • User access – login events, failed login attempts, and permission changes
  • Settings changes – modifications to the chart of accounts, tax rates, financial year, or user roles

This level of detail means your accountant, auditor, or HMRC can trace any figure in your accounts back to its original entry and see its full history.

How to Access the Audit Trail in Xero

Xero provides several ways to view audit information:

Account Transactions Report

Go to Accounting > Reports > Account Transactions. This shows every transaction posted to a specific account over a date range. Useful when you need to verify how a balance was calculated or trace a specific entry.

History and Notes on Individual Transactions

Open any invoice, bill, or payment and scroll to the bottom. You’ll see a History & Notes section showing every change made to that transaction – including timestamps, user names, and what was modified. This is the most granular audit view.

Activity Feed (Audit Log)

Go to Settings > General Settings > Audit Log. This shows user activity across the organisation: logins, transaction edits, and settings changes. Filter by date range or user to investigate specific activity.

Why the Audit Trail Matters for UK Businesses

HMRC compliance

HMRC expects businesses to keep records that support their tax returns. Under Making Tax Digital, these records must be digital. Xero’s audit trail satisfies this requirement because it maintains a verifiable chain from source documents (bank transactions, invoices) through to the final tax return figures.

If HMRC opens an enquiry into your tax return, the audit trail lets you demonstrate exactly how each figure was calculated. This is far stronger evidence than a box of paper receipts.

Statutory audits

Companies that exceed the audit threshold (turnover above £10.2 million, balance sheet above £5.1 million, or more than 50 employees) must have their accounts audited by a registered auditor. The auditor needs to verify that transactions are genuine, complete, and correctly recorded.

Xero’s audit trail makes this process significantly easier. Auditors can trace any sample transaction through its full lifecycle without requesting additional documentation. Many audit firms now prefer clients who use cloud accounting software like Xero because the audit trail is built in rather than having to be manually compiled.

Internal controls and fraud prevention

The audit trail is also a deterrent against internal fraud. If every change is logged with a username and timestamp, staff know their actions are recorded. Common issues the audit trail catches:

  • Invoices amended after approval (changing the amount or payee)
  • Transactions deleted to hide expenses
  • Unauthorised access outside business hours
  • Changes to bank account details on supplier records

Using Xero’s Assurance Dashboard

The Assurance Dashboard in Xero (available to accountants and bookkeepers through Xero HQ) provides an overview of data quality across client organisations. It highlights:

  • Unreconciled bank transactions – flags accounts with backlogs
  • Overdue invoices and bills – identifies cash flow risks
  • VAT return status – shows which returns are filed, pending, or overdue
  • Bank feed health – alerts when a bank feed has disconnected

For accountants managing multiple clients, the dashboard gives an instant view of which organisations need attention. For business owners, ask your accountant to walk you through the dashboard – it shows exactly how “healthy” your books are.

Xero Security Certifications

Beyond the audit trail, Xero holds two key security certifications relevant to audit and assurance:

  • ISO 27001 – the international standard for information security management, covering data handling, access control, and incident response
  • SOC 2 Type II – verifies that Xero’s security controls operate effectively over time, audited annually by an independent firm

These certifications mean that auditors can rely on Xero’s data integrity without needing to audit the software platform itself. This is known as a “service organisation controls” report and it simplifies the audit process for any business using Xero.

Preparing for an Audit Using Xero

If your business is subject to a statutory audit or voluntary audit, here’s how to prepare using Xero:

  1. Reconcile all bank accounts up to the year-end date. No unreconciled items should remain.
  2. Review outstanding invoices and bills – write off bad debts, accrue for late supplier invoices
  3. Run a trial balance for the year-end date and compare it to the prior year
  4. Check the fixed asset register – make sure depreciation has been run and disposals recorded
  5. Invite your auditor as a read-only user so they can access reports and the audit trail directly

Giving your auditor direct Xero access speeds up the audit significantly. Instead of exchanging emails and spreadsheets, they can pull the reports they need, drill into any transaction, and review the audit trail – all from their own login.

Frequently Asked Questions

Can I export the Xero audit trail to Excel?

Yes. Go to Accounting > Reports > Account Transactions, select your date range, and click Export. Xero generates a CSV file you can open in Excel. This is useful for auditors who want to work with the data in their own tools, or for archiving audit trail records at year-end.

Is the Xero audit trail secure?

Yes. The audit trail is tamper-proof – no user, including administrators, can edit or delete audit log entries. This is a core part of Xero’s security architecture and is verified through their annual SOC 2 Type II audit. Your prior-year records remain intact and accessible indefinitely.

How far back does the Xero audit trail go?

The audit trail covers the entire history of your Xero organisation from the date it was created. There is no expiry or automatic deletion. HMRC requires you to keep financial records for at least six years, and Xero’s audit trail satisfies this requirement automatically.

Can different users see the audit trail?

Users with Standard or Advisor access can view the History and Notes section on individual transactions. Only Advisor-level users and above can access the full Activity Log under Settings. Read-only users cannot see audit trail information.

How JacRox Can Help

We prepare businesses for audits every year. From year-end account preparation to audit-ready Xero setups, we make sure your records are clean, your audit trail is complete, and your auditor has everything they need.

Need help getting audit-ready? Get in touch and we’ll review your Xero setup.

Related guides: Xero reporting guide | User permissions in Xero | Xero security features

Not sure where to start? our chartered accountants can walk you through it.