Auditing and Digital Paper Trail

Wise Owl Legal supports a variety of auditing functions to comply with legal requirements for transparency and external auditing. In addition, audit logs are useful to ensure the correct and error free operation of your Wise Owl Legal appliance.

There are different auditing mechanisms used by Wise Owl, they all create a digital paper trail, but some are focused on particular modules or scenarios For example, the entire trust accounting system is designed from the ground up to leave an auditable, transparent digital paper trail. Other system functions and events are logged in a more generic audit log which can also be used as a digital paper trail.

Backups

Wise Owl Legal back up information is at Backups by Wise Owl Legal or https://wiseowllegal.atlassian.net/wiki/spaces/WOH/pages/139165697/Backups+by+Wise+Owl+Legal

External Audit

Law firms can be audited at any time. Some of the rules to remember include:

The firm's trust records must be available for audit at any time
- This means trust records must not be taken off site by anyone
- Not by a bookkeeper, principal of the firm, nor an auditor!
You must reconcile your trust account within 14 days of the end of the month.
- This means don’t put it off! All computer generated reports are dated, allowing auditors to easily verify if this deadline has been met.
Never draw a cheque without having first receipted the money into your accounting system.
If you make a mistake, make it very clear what happened and what you did to fix it. Ensure there are memos filed with the End Of Month Reports indicating the mistake, and the appropriate actions taken to amend it. Mistakes happen, but trying to hide them makes it worse.

Filing of Trust Record - Soft Copy (recommended)

We recommend the best way to file trust records is to use a new folder on your computer, for the trust audit year, 1st April to 31st March. We suggest “Trust 24-25” where the “24-25” is the year of the audit.

For Example, in Australia all trust accounts are audited to 31 March each year, year ending 31 March 2025 would be the 24-25 year.

This folder should contain the following sub folders:

Receipts: Trust receipts, office copy, filed in strict numerical order
Deposits: Trust deposit slips
Bank Statements
A folder for each month where you save Trust end of month reports, named like “24-10 October”
Whole year reports: run after the end of the year to assist the auditor only look at one set of ledger reports to see the whole year.

Filing of Trust Record - Hard Copy

We recommend the best way to file trust records is to use a lever arch folder, for the trust audit year, 1st April to 31st March.

This file should contain:

Trust receipts, office copy, filed in strict numerical order
Trust deposit slips
Trust end of month reports, with one tab for each month
A separate tab for the trust account bank statements

Trust Accounting

For more information on Trust Accounting Audits, please see the help page at How do I prepare for a Trust Audit?

Generic Audit Log

The generic audit log is a system wide repository of events. Its purpose is to log, in a structured manner, important events in the system such as changes to matters, user logins and system updates. Records are unable to be edited once created. Audit records are only accessible to administrators of Wise Owl and help desk staff.

For more information on using the audit logs, please see Audit - Search

Audit records contain, at minimum:

When the event occurred
What kind of event it was
Who (which user) initiated the event
The IP Address of the user who initiated the event
A brief summary of the event

Additional information can be recorded, depending on the context of the event:

Did the event succeed or fail e.g. a login may fail due to an incorrect password.
Additional details of the event. These vary considerably depending on event type and context
A snapshot before and after the event e.g. when a matter or system setting is changed, the data before and after is recorded
A variety of associated record IDs. These represent other records in Wise Owl which are relevant to the event being audited e.g. When a matter changes, the matter ID will be recorded against the audit record or, for a password reset, both the user who resets the password and the user whose password is being reset are recorded.

Information from the audit log is searchable via the Tools module.

Events Recorded

The following table lists each event audited by Wise Owl Legal:

Event	Details

Event	Details
General and System Events
Support / Feedback Requests	Details of support requests, feedback items or bug reports are saved in the audit log as well as being sent to the Wise Owl Helpdesk.
Unsupported Browser Override	Happens if a user ignores the warning that their browser is unsupported or out of date. Note, using Wise Owl with an unsupported browser may mean the Helpdesk cannot provide support to the user.
Install Update	A system update is installed from the Appliance Settings.
System Setting Changed	Logged whenever system settings are changed. A snapshot of the setting before and after the change are recorded.
Initial Setup Completed	An event indicating the Appliance has completed the manufacturing setup process.
List Edited	One of the generic drop down lists (such as countries, address types or matter referral sources) has been edited. Before and after snapshots are taken of the list.
License Related
License Tampering	There are several audit events which indicate your license may be tampered with. They are not listed here; you should never see them.
License Expired	The Appliance license has expired. It will now be running in grace period with degraded functionality.
License Grace Period Expired	The Appliance license grace period has expired. The Appliance will be running in read-only mode with extremely limited functionality.
License Not Connected to Internet	The Appliance has not been able to connect to the Wise Owl License Server in several days. The Appliance may be running with reduced functionality.
Users and Logins
User Login	A user has logged into Wise Owl Legal. The login may or may not be successful.
User Logout	A user has logged off Wise Owl Legal by clicking the logoff button.
User Timeout	A user's session has expired due to inactivity and they were automatically logged off.
User Kicked	A user was forcefully kicked from Wise Owl Legal. Detail of who kicked the user are recorded.
User Created	A new user was created.
User Edited	A user's details were edited. This may be by themselves or by another admin user. Before and after snapshots are taken.
User Changed Password	A user changed their password.
User Reset Password	A user's password was reset by an administrator.
User Sent Forgotten Password	A user reset their own password by clicking on the "forgotten password" link. They would have received an email with a code to change their password.
User Deactivated	A user's account was deactivated.
User Reactivated	A user's account was re-activated after a previous deactivation.
User Rights or Role Changed	A user's roles or rights overrides have been changed by an administrator. Before and after snapshots are taken.
User Deactivated Tutorial	A user deactivated the Wise Owl Legal tutorial displayed after login.
User Account Locked	A user's account was locked due to excessive logins or suspicious activity. An admin must unlock the account before they can login again.
Rights Assignment Changed	The assignment of rights in a role have been changed. Before and after snapshots are taken.
Unauthorised Access	A user tried to visit an unauthorised page or resource.
Contact Events
Contact Created	A new contact was created.
Contact Edited	A contact's details were changed. Before and after snapshots are taken. If this contact is a client and is present on an open or recent matter, a Matter Edited event will also be logged with client details.
Contact Number Edited	A contact's contact number was manually overridden. Before and after snapshots are taken.
Contact Deactivated	A contact has been marked as inactive. Before and after snapshots are taken.
Contact Number Sequence Changed	The Appliance-wide number sequence for contact numbers was changed. Before and after snapshots are taken.
Matter Events
Matter Created	A new matter was created. Full details of the matter including full client details are logged.
Matted Edited	A matter was edited. Before and after snapshots are taken. This records can be logged if the details of a matter's client are changed.
Matter Number Edited	A matter's matter number was manually overridden. Before and after snapshots are taken.
Matter Number Sequence Changed	The Appliance-wide number sequence for matter numbers was changed. Before and after snapshots are taken.
Matter Jurisdiction Changed	A matter's jurisdiction was manually changed. Before and after snapshots are taken.
Conflict Check Complete	A conflict check was completed for a matter. This records the fee earner for which the conflict check was performed for and the user who recorded it.
Sent Trust Authority	Trust authority was recorded as sent for a matter.
Matter Type Changed	A matter's matter type field was manually changed. Before and after snapshots are taken.
Matter Closed	A previously open matter was marked as closed.
Matter Archived	A previously closed matter was marked as archived.
Matter Re-Opened	A previously closed or archived matter was marked as open again.

Appliance Logs

The Wise Owl Appliance keeps low level system logs. These contain information primarily relevant to technical support, debugging and performance analysis. They can be accessed from the Tools module and exported to an Excel compatible format for external analysis. Unlike the Generic Audit Log, Appliance logs mostly free-form text rather than structured database records. The appliance logs are where details of errors are recorded, plus a variety of other data and statistics. They are not designed to maintain a digital paper trail, but may be used as supporting evidence.

TODO: streaming important messages back to our stats server???