The change log records who created, changed or deleted what in your organisation, and when – for risks, assets, measures, policies, documents, incidents, findings, exceptions and all other areas. This article explains who sees the log, how you filter and export it and how you read the history of a single object. It is aimed at internal and external audit and at ISMS managers.

Before you start

  • The change log is visible to people with the “View audit log” permission. By default, the functional roles Internal audit & review (read only) and ISMS manager have it – and therefore every Tenant Admin too.
  • You find it under ISMS management › Change log. You do not need administration permissions for it.
  • Entries cannot be changed or deleted, not even by Tenant Admins.

What the log records

Each entry shows:

  • Time: when the change was saved (Swiss time).
  • Object: identifier and title or name, for example “M007 · Check backup”, with the area below it, such as “Measures”.
  • Action: Created, Changed or Deleted, plus special actions such as “Member added”.
  • Changes: the changed details as “Field: old → new”, for example “Status: Draft → Approved”. For newly created objects, the most important details are shown. Long texts are shortened; details without their own label appear as “further details”.
  • Person: who made the change. “No person” appears for automatic steps, anonymous reports and people who are no longer members; “Unknown” for changes made outside your organisation, for example when the Varmo operations team updates a catalogue.

How to do it

  1. Open ISMS management › Change log.
  2. Choose the Period: Last 7 days, Last 30 days (default), Last 90 days, Last year or All.
  3. If needed, narrow it down to a Person or an Area, for example “Risks” or “Documents & evidence”.
  4. The page shows 50 entries, newest first. Use Older entries to page further.
  5. Use CSV to download the filtered entries, for example as evidence for an audit.

History of an object

On the page of a risk, asset, measure, policy, document, incident, finding or exception, the History section appears at the bottom. Click it to expand it. It shows the entries for this object, together with related entries such as new versions of a policy, comments or responsible persons. The section is only visible to people who can also see the change log.

What happens next

  • New entries appear immediately.
  • The change log is kept for as long as the organisation exists. If the organisation is permanently deleted, the log is deleted as well.

Frequently asked questions

Why can't I see the menu item?

You do not have the “View audit log” permission. A Tenant Admin or the ISMS managers can assign you the functional role Internal audit & review (read only). See Functional roles and permissions.

Does audit see more with the log than otherwise?

The log contains the details of all areas of your organisation. That is why it is reserved for the “View audit log” permission; only grant it to people who are allowed to see everything.

Can I correct or delete an entry?

No. Entries cannot be changed or deleted, so that the log is valid as evidence.