6.5 Audit and step-up

The audit trail that records each read, change and refusal, and the passkey check that guards the most serious acts.

Written forPrincipal and executiveITRegistrarBusiness manager

What the audit trail is for

Kestrel writes an entry each time someone reads a record, adds one, changes one, removes one or is refused. Each entry says who, what, which record and why. The trail lets a school answer "who looked at this" months later.

The trail is chained, so an entry cannot be changed or removed without showing. The screen tells you whether it is intact.

Reading the trail

The screen is "Audit trail", and its lede is "See when school records were viewed or changed, and by whom." The principal reaches it from the account menu. The views are "Read", "Created", "Changed", "Deleted" and "Refused". Narrow the list with "Who", which takes a name, an address or an id, and "Which record", which takes one record's reference, and with a date range. The columns are Who, "What they did", When and Entry.

1. Open the account menu from your initials and choose "Audit trail".
2. Choose a view such as "Read" or "Refused".
3. Fill "Who" or "Which record" and set the dates.
4. Choose a row to read its entry, titled "Entry" with its number.
5. Press "Show earlier entries" to go further back. When nothing matches, the page says "Nothing matches that".

• Read the audit trail. Read the audit trail

Checking the trail is intact

Above the list the screen reports on its own integrity. When all is well it reads that a number of entries exist "and nothing in them has been changed or removed since they were written". Three alarms are possible: "An entry was changed", "An entry is gone" and "An entry is out of order". The next step is printed with the alarm: "First, take a copy below as evidence of what the trail shows now. Then tell whoever runs Kestrel for your school."

Taking a copy

A school sometimes needs to hand over part of the trail, for example for a subject access request. Under "Take a copy", fill "Why this copy is needed" with a reason such as who asked. The reason is stored with the entry and kept as long as the trail is. Then press "Copy" or "Download" with the number of rows, as a CSV file. Kestrel confirms with the number of entries copied and that "The copy is recorded in the audit trail." If you leave the reason empty it says "Tell us why you need this copy. The reason is recorded with your name."

• Audit trail

  /app/settings/audit

  Read, filter, check and copy the trail.

  Needs tenant.audit.read

Step-up: your passkey again

Some acts are serious enough that a signed-in session is not enough. Producing a statutory return file, a variation pack for a confirmation of enrolment, and the staff import ask you to confirm with your passkey, however recently you signed in. An emailed code does not count. After you confirm, the next five minutes are covered.

If the window has passed, the refusal reads "This needs your passkey again. Confirming it covers the next five minutes." Confirm with your passkey and repeat the act. The audit entry for the act records that a step-up was used and how old it was.

• Add a passkey. Add a passkey for another device

• A statutory return

  /app/exports/[key]

  Check a return and press "Produce the file". The file is made with your passkey.

• 5.8 Imports and returns
• 5.9 Accountability

Training notes

• Show the principal where "Audit trail" is, and run a search for "Refused" together.
• Explain that an alarm on the trail means stop and take a copy first.
• Register a passkey on each device staff use for returns.