Audit History and Evidence
Explain who changed a financial or migration decision and why.
CoreFinOps auditability is designed around the identity of an actor, the selected tenant, the affected resource or workload, the action taken, the timestamp, and the evidence or reason for a decision.
What belongs in an audit trail
Relevant events include AWS connection changes, financial rule changes, importer commits, assessment overrides, readiness exceptions, wave changes, cutover, decommission confirmation, approvals, value verification and access administration.
Distinguish audit from data freshness
Audit time indicates when a user or service changed a CoreFinOps record. It is not the time AWS billed a cost fact or when a recommendation source observed a resource.
Evidence permissions
Customer cost exports and documents may be sensitive. Avoid placing AWS role secrets, ExternalIds, raw Marketplace registration tokens or payment credentials in audit logs or public reports.
Security
Review example
If financial decommission was confirmed, reviewers should be able to find who confirmed it, the remaining source amount, the evidence that justified removal or the approved exception, and the relevant currency. Without that context, the stage should remain incomplete.