Audit Trail

Why audit trails matter

Audit trails serve three distinct purposes in M&A and other high-stakes data sharing. First, they are a real-time security signal — unusual access patterns trigger administrator review. Second, they feed deal intelligence: sellers can see which bidders looked at which documents and how long they spent, which informs negotiation. Third, and most consequentially, they are admissible evidence. If a deal collapses and the seller is later accused of withholding material information, the audit trail proves exactly which documents each bidder accessed.

What a complete audit trail captures

A defensible audit trail records, at minimum:

• User identity — email, role, and group at the time of action
• Action type — view, download, print, upload, delete, permission change
• Document identifier — file name and version
• Timestamp — date and time, ideally to the second
• Source IP and device — for geographic and access-control review
• Duration — how long a viewer spent on each page (in advanced VDRs)
• Result — success, denial, error

Top-tier VDRs also capture failed access attempts, which are critical for detecting probing behavior.

Granularity: file-level vs page-level

Basic audit trails record file-level events (“user X opened document Y”). Advanced VDR audit trails go to the page level, recording how long a viewer spent on each page of a document and whether they downloaded any pages individually. Page-level data drives heatmaps that show seller-side teams which sections of a CIM or financial model the bidders care about.

Use in litigation and disputes

After a deal closes (or fails), the audit trail can become evidence. Common scenarios:

• A buyer alleges the seller withheld material information. The seller produces the audit trail showing the buyer’s counsel accessed the relevant document on a specific date.
• A bidder claims unequal access. The administrator produces the trail showing all bidders received identical permissions and timing.
• An employee is suspected of leaking documents. The trail identifies who downloaded what before leaving.

For audit trails to hold up, they must be tamper-evident: administrators cannot edit or delete entries, and the log itself is cryptographically protected.

Real-world example

A mid-market software company runs a competitive sale to four strategic buyers. Two weeks into diligence, one bidder claims they were never given access to the customer contracts folder. The administrator pulls the audit trail and shows the bidder’s lead counsel viewed the folder on day three and downloaded six of eight contracts. The bidder’s claim is dropped.

Common mistakes

• Treating audit trails as IT exhaust. They are deal evidence and should be preserved per a retention policy aligned with the statute of limitations on reps and warranties.
• Granting administrators delete rights to the log itself. Defeats the tamper-evident requirement.
• Not exporting the trail at closing. Many sellers lose access to the VDR after the deal, then can’t produce records when disputes arise 18 months later. Export at closing as standard practice.