The best evidence to determine whether transactions have been executed by authorized employees is audit trails. Audit trails are secure records that catalog events or procedures to provide support documentation. They are used to authenticate security and operational actions, mitigate challenges, or provide proof of compliance and operational integrity2. Audit trails can track and trace the following information related to transactions:

Who initiated, approved, modified, or deleted a transaction

When a transaction occurred (date and time)

Where a transaction took place (location or device)

What type of transaction was performed (action or operation)

Why a transaction was executed (purpose or reason)

By analyzing audit trails, an IS auditor can verify whether transactions have been executed by authorized employees or not. Audit trails can also identify any unauthorized, fraudulent, or erroneous transactions that may have occurred. Audit trails can also help to resolve any disputes or discrepancies that may arise from transactions.