Require Audit Trail

[Zuora-Support]

Feature Request: Require Audit Trail

Status: under evaluation

Reference Number: DE5826/PMT-876

Business Need:

There are business requirements that are looking for the ability to have an audit trail for all fields and records. The requirement is to have an audit trail on all

- Account fields (including all custom fields)
- Subscription Fields (including all custom fields)
- Contact Address Fields (including all custom fields)
- Settings changes
- Users' actions

[mviau]

We've had an issue where a Zuora Admin on our side disabled a user that was used for Production API connectivity due to that real person no longer working for the company.

I urgently raised a ticket to know what happened to that  user not knowing the admin had done that and it took 2 days to get a response albeit marked as Critical and Production affecting.  See:

https://support.zuora.com/hc/en-us/requests/82232

If we had admin audit trail I could have easily seen that our admin ("Madison") had disabled that user and fixed that up.

So having visibility of audit log would be tremendously useful.

Martin

[bsanders]

Hi, Is there any update on when this will be released? Having an Audit trail is needed not only as datapoint for remediation, but is also required from a security compliance standpoint where auditors require us to provide explanations of why changes happened and we need to know who made the changes.

[joel_buaron]

Hope you are having a great day @bsanders. Last Product Release session that I saw does not include this yet but let me check with our Product Management team and have them post something here if there is any development.

[bsanders]

@joel_buaron Thank You. I did not see anything in the April release notes https://knowledgecenter.zuora.com/AA_Whats_New/AA_Zuora_Release_Notes.

[lukasz]

We are still sorting out the exact timing of this feature, but it will likely arrive in Q4 of 2016. I'll provide updates as the dates firm up.

[Kyle]

Hi Lukasz,

Ideally, it should be a separate object called audit history that tracks all field changes. In this way, it can be shown on UI and used in reporting. Just a thought.

Thanks,

Kyle

[lukasz]

 Hey @Kyle, that's the idea. We're planning on capturing the when, what, and who of the following three classes of changes:

1. Changes to any Zuora logical objects, like Account, Contact, Subscription, Product, etc.
2. Changes to any Zuora settings, like roles and permission, billing settings, payment terms, etc.
3. Any time a user logs in and out.

All of this data will then be exposed via data-source-like interface to be queried, filtered, and analyzed as necessary. It remains to be seen whether we leverage this mechanism for the respective history sections within the UI and how it would surface within Reporting (outside of it's own dedicated extract).

[sunyu]

Vote +1 lol

thanks team

Sun

[jmorrissey]

Is there an update to this / is the change coming in 2016.  These are crucial tools in demonstrating adherence to SOX controls.  We are hoping this is a 4Q16 still.  The lack of these auditing tools is a problem, as our tenant is coming under scope for SOX audits.  As an earlier comment stated, "Having an Audit trail is needed not only as datapoint for remediation, but is also required from a security compliance standpoint where auditors require us to provide explanations of why changes happened and we need to know who made the changes."