Can an audit trail be trusted if the people who produce the figures can also change the log?

Audit trail integrity is the property that makes a record of changes worth reading. This paper asks one question. If the people who produce a carbon figure can also delete or alter the log of how it was produced is that log evidence? The answer is already written down. ISO/IEC 27002 states in control 8.15 that users including those holding privileged access rights should not have permission to delete or deactivate logs of their own activities because they can otherwise manipulate the logs on facilities under their direct control [1]. Control 8.15 is one of 93 Annex A controls in ISO/IEC 27001 in its 2022 revision [2]. The supporting evidence is blunter than the standard. In a study of 2402 occupational fraud cases 89% involved at least one concealment method [4]. In a study of major US public companies published in Nature Climate Change 58% of self reported emissions figures were later revised and external assurance did not explain which companies revised them

Summary of findings

The findings in six numbers

Source. ISO/IEC 27002 and ISO/IEC 27001 [1] [2] the ACFE Occupational Fraud 2026 study [4] Cohen and Rouen and Sachdeva in Nature Climate Change [5] the DESNZ conversion factor sets [6] [7] and the FRC Annual Review of Audit Quality 2026 [14]. Percentages are as published. The 89% is calculated by this paper as the complement of the published 11%.

The standard is not ambiguous. It does not say that a log should exist. It says that the identity performing an action should not hold the rights to remove the record of that action [1]. Those are different requirements and only the second one can be tested.

The gap that matters is between a policy and a permission. A team can be told to leave a closed period alone. That is a convention. A team that cannot technically reopen the period and cannot remove the entry recording an attempt is under a control. An assurance provider is trained to tell the two apart and the published trust commitment at Sustainify AI is the technical version. It states two roles only with editors unable to grant themselves administrator rights [3].

The carbon figure is the part most exposed. A conversion factor set is republished every year so the same consumption produces a different result depending on which set was applied. In the worked example in Finding 5 a silent re run of one year on a newer factor set moves a published figure by 460.4 tCO2e which is 26.0% without a single meter reading changing.

Why audit trail integrity matters for a UK property portfolio

Four separate obligations now rest on figures that have to stay the same after they are published.

SECR is a directors report disclosure filed with the accounts and signed off by the board which is a different standard of care from a voluntary sustainability report. The SECR reporting requirement includes the comparable prior year figures so last year has to still be last year.

Under the final rules the FCA published on 30 September 2026 in Policy Statement PS26/19 listed companies in scope report against UK SRS S1 and S2 on a comply or explain basis for accounting periods beginning on or after 1 January 2027 with first reports in 2028 [15]. The FCA did not make assurance mandatory. It requires an issuer to confirm in the annual report whether third party assurance was obtained from whom over what and at what level [15]. A company that says no has to be comfortable that its own record is the evidence.

For a group in scope of the Corporate Sustainability Reporting Directive assurance is mandatory and limited. Directive (EU) 2026/470 published in the Official Journal on 26 February 2026 and in force from 18 March 2026 removed the to move to reasonable assurance and left limited assurance as the standing requirement with harmonised EU limited assurance standards due by 1 July 2027 [16]. CSRD reporting therefore means an outside practitioner testing a process that was previously only tested internally.

The fourth is contractual. A sustainability performance target written into a sustainability linked facility moves a margin in basis points. A tenant recharge is a figure an occupier has a direct financial reason to challenge line by line. Neither survives an audit trail that the producing team can edit.

Definitions

An audit trail is the record of who changed what when and why held alongside the data rather than reconstructed from it afterwards. Calculation lineage is the recorded chain connecting a reported figure back through every step that produced it to the invoice meter reading or submission it came from and the factor set applied to it. Period locking closes a reporting period so the figures in it cannot be changed without a recorded and authorised reopening. Factor versioning is holding every published conversion factor set separately and recording which one produced each figure. A restatement is a formal correction of a previously published figure disclosed as a restatement with the reason given rather than a quiet edit to the underlying data. An evidence pack is the assembled set of source documents and calculation records supporting a disclosure. A data quality grade records how a figure was obtained distinguishing metered readings from invoiced quantities and from estimates. These terms are defined in the Sustainify AI glossary.

Segregation of duties is the separation of conflicting duties so that one person cannot both perform an act and authorise or conceal it. It is control 5.3 in Annex A of ISO/IEC 27001 [2]. Privileged access rights are the elevated permissions usually administrator permissions that allow configuration and data to be changed outside the ordinary application. An information security management system is the governed set of policies roles and controls an organisation operates and has certified. A Statement of Applicability records which Annex A controls an organisation applies and why.

Forward integrity is the property that entries written before a system is compromised cannot afterwards be altered without detection. An append only store accepts new records and refuses edits and deletions to existing ones. Write once read many storage usually shortened to WORM enforces that at the storage layer. A run ID is the unique identifier of a single calculation run so every figure the run produced can be found together. Limited assurance is a conclusion expressed negatively after sampling and reasonable assurance is a materially higher bar closer to a financial audit.

Method

Four primary sources were read on 29 October 2026. The implementation guidance for control 8.15 of ISO/IEC 27002 and the Annex A control structure of ISO/IEC 27001 [1] [2]. The Sustainify AI Trust Centre for the certified entity the certificate number and the published access control commitment [3]. The Occupational Fraud 2026 study published by the Association of Certified Fraud Examiners [4]. The Nature Climate Change article on revisions to self reported emissions [5].

The regulatory positions were read at their own publications. The FCA Policy Statement PS26/19 of 30 September 2026 [15] and the Omnibus I Directive (EU) 2026/470 [16]. The audit inspection figures come from the FRC Annual Review of Audit Quality 2026 [14]. The conversion factors come from the DESNZ greenhouse gas conversion factor sets for 2025 and 2026 [6] [7].

The worked example in Finding 5 uses an invented portfolio and is labelled as such. It applies the UK electricity generation factor of 0.17700 kgCO2e per kWh from the 2025 set and 0.13096 from the 2026 set [6] [7]. The arithmetic is set out in full so a reader can repeat it. The six peer reviewed papers in Finding 6 were found through Google Scholar and each was checked at its publisher page its Digital Object Identifier record or an open conference copy.

Two related questions are answered elsewhere in the Insights section. What locking a reporting period means is covered separately and the hourly matching consultation paper covers why a Scope 2 figure may have to stay reproducible under a rule that has not been written yet. This paper does not restate either. It asks whether a lock means anything without access control beneath it.

Findings

Finding 1. The standard answers the question directly and the answer is no

ISO/IEC 27002 sets out the implementation guidance behind the Annex A controls of ISO/IEC 27001. Control 8.15 covers logging. Under the protection of logs the guidance states that users including those with privileged access rights should not have permission to delete or deactivate logs of their own activities and that the logs therefore have to be protected and reviewed to maintain accountability for privileged users [1]. The same guidance asks that logs be protected against unauthorised changes to the message types recorded against log files being edited or deleted and against storage capacity running out and overwriting history [1].

Read that against the question in the title. A carbon figure is produced by a person or by a job running under an identity. If that same identity can remove the record of what it did the record is not independent of the act. It describes the act only for as long as nobody has a reason to change the description.

The requirement is narrower than it first sounds and worth stating precisely. The control does not say that nothing may ever be changed. It says the person who performed an action should not hold the rights to remove the record of it. A platform can allow a figure to be corrected and still satisfy the control provided the correction is itself an entry nobody involved can erase.

Finding 2. One control does not carry the claim. Four do

ISO/IEC 27001 in its 2022 revision reorganised Annex A from 114 controls in 14 domains into 93 controls in four themes with 37 organisational 8 people 14 physical and 34 technological controls [2]. Logging is one of them. On its own it produces a record. It takes three others to make that record hold.

Table 1. The four Annex A controls that together answer the question

Source. Annex A of ISO/IEC 27001 and the implementation guidance in ISO/IEC 27002 [1] [2]. Control names are as published. The third column is this paper applying them to a carbon reporting system.

The Sustainify AI Trust Centre states the access control position in one line. Two roles only and editors cannot grant themselves administrator rights [3]. That is control 5.3 and control 8.2 expressed as a product behaviour rather than as a policy. The certified entity is Codedevza AI Ltd which builds and operates the platform under certificate 1N719TSI20261008GBRIS18Y issued by TNV System Certification and accredited by IAS an IAF MLA signatory [3].

What that certificate does not do is covered in Limitations. An information security management system is certified against how information is protected. It is not an opinion on whether a carbon figure is correct.

Finding 3. Concealment is the normal behaviour in a fraud case not the exception

Occupational Fraud 2026 the fourteenth edition of the Report to the Nations analysed 2402 real cases across 143 countries and territories [4]. The concealment figures are the part relevant to anybody designing a log.

Table 2. How occupational fraud was concealed

Source. Occupational Fraud 2026 concealment section [4]. The categories are not mutually exclusive and do not sum to 100%. The complement of the 11% is 89% calculated by this paper.

Only 11% of cases involved no concealment so 89% involved at least one method [4]. Tips remained the most common way a fraud was first detected at 43% of cases which has held across all fourteen editions since 1996 [4].

The design implication is not that carbon teams commit fraud. Occupational fraud is a different population from sustainability reporting and this paper does not claim otherwise. The implication is narrower. Where a record can be edited by the person it describes editing it is a documented human behaviour with thirty years of case data behind it and a control framework that assumes otherwise is assuming against the evidence.

Finding 4. External assurance did not explain which emissions figures later moved

Cohen and Rouen and Sachdeva examined the corporate social responsibility reports of major US companies across a decade and published the result in Nature Climate Change in January 2026 [5].

Table 3. What the restatement study found

Source. Abstract and extended data of Cohen and Rouen and Sachdeva [5]. The study covers US corporate social responsibility reports and not UK real estate.

The finding that matters here is the fifth row. If assurance were enough on its own assured figures would move less often than unassured ones. In this sample the presence of assurance did not explain the likelihood of a revision [5].

That is not an argument against assurance. Limited assurance samples rather than traces and a sample cannot see what a complete record would show. It is an argument that the record under the figure has to carry its own weight because the thing most often relied on to guarantee it does not predict whether it will move.

Finding 5. A worked example. A silent re run moves a published figure by 26.0% with no meter reading changing

The following is a worked example and not an observed portfolio. A landlord reports landlord controlled electricity of 10000000 kWh for a reporting period covering 2025. The location based Scope 2 figure is produced under the 2025 conversion factor set. DESNZ published the 2026 set on 11 June 2026 and the UK electricity generation factor fell from 0.17700 to 0.13096 kgCO2e per kWh a fall of 26.0% [6] [7].

Table 4. The same consumption under two factor sets

Source. Worked example by this paper. Factors from the DESNZ 2025 and 2026 conversion factor sets [6] [7]. The portfolio is invented. The arithmetic is 10000000 multiplied by the factor divided by 1000 to convert kilograms to tonnes.

Now make the re run partial which is the realistic case. Somebody reprocesses part of the estate against the newer set and leaves the rest alone. The reported total falls by an amount that looks exactly like a real reduction.

Table 5. A partial re run against a mixed factor set

Source. Worked example by this paper on the same invented portfolio and the same two factors [6] [7]. Each row is 10000000 kWh priced at the weighted average of the two factors at that share.

A 30% re run produces a 7.8% fall. That is the size of a plausible efficiency programme across a managed estate. A reader looking only at the published total cannot distinguish the two cases. A reader holding the run ID the factor set and the period can and so can an assurance provider.

This is where the access question becomes commercial rather than technical. If the person who ran the recalculation can also remove the entry recording that it happened nothing in the published figure reveals it. The lock on the period is only as strong as the control over who can reopen it and who can erase the record of the reopening.

Finding 6. The computer science literature assumes the holder of the log is untrusted

Secure logging has been a research field since the late 1990s and it starts from the opposite assumption to most reporting software. It does not ask whether the log exists. It asks what the log is worth once the machine holding it is under hostile control.

Table 6. What the peer reviewed secure logging literature establishes

Source. Full text or abstracts of the papers cited found through Google Scholar and checked at their publisher records. Titles are reproduced without the punctuation of the originals.

Two things follow for a carbon platform. First the word that matters is not logged but append only. A record that can be rewritten by the system that wrote it is a report not evidence. Second verification by somebody outside the producing team is what the literature treats as the end state which is the same thing an assurance provider is paid to do.

None of these papers is about carbon accounting and this paper does not claim they are. They establish the property a log needs. They do not establish that any particular reporting system has it.

Finding 7. The UK audit regulator keeps returning to the same control area

The FRC inspected 116 individual audits across the public interest entity audit market in its Annual Review of Audit Quality 2026. 79% were assessed as good or requiring no more than limited improvements unchanged on the previous year and three required significant improvements against ten a year earlier [14]. Among the largest six firms the average was 83%. Outside that group 46% of audits inspected required no more than limited improvements up from 38% [14].

General information technology controls have been a recurring FRC inspection finding area alongside revenue estimates and journals testing. The regulator has stated that where an audit approach relies on information technology systems data and automated controls the related general information technology controls should be tested to a level that supports the reliance placed on them.

The relevance is indirect and should be read as such. These inspections cover financial statement audits and not sustainability assurance. They show that the control layer underneath system generated information is the layer inspectors go to in a profession that has been testing it for decades. Sustainability assurance is on the same path and arrives at the same question.

What this means in practice

Seven tests to put to an audit trail before treating it as evidence

Table 7. The seven tests

Source. Tests 1 2 5 and 7 follow the implementation guidance for control 8.15 of ISO/IEC 27002 [1]. Tests 3 4 and 6 are this paper applying that guidance to carbon reporting.

Five actions before the next reporting cycle

1. Ask who holds the delete right not whether a log exists

Every system has a log. The testable question is whether the people who produce the figures can remove entries from it. Ask for the permission matrix rather than the feature list and ask to be shown the attempt failing.

2. Separate producing a figure from administering the record of it

Control 5.3 is about conflicting duties rather than about trust [2]. Where the team is too small to separate the roles separate the store instead by sending the log somewhere the producing team cannot reach.

3. Lock the period and log the reopening

A lock that can be lifted without a record is a label. The reopening is the event worth capturing because it is the one a reader of the restated figure will ask about.

4. Pin the factor set to the period rather than to the calculation date

Finding 5 shows the size of the exposure. A figure produced under the 2025 set has to stay on the 2025 set unless somebody decides otherwise and that decision is recorded as a restatement.

5. Run the seven tests before the assurance provider does

Limited assurance samples. A sample that lands on the one period where the record is thin produces a finding that is expensive at the wrong moment in the year.

How Sustainify AI handles audit trail integrity

Carbon data governance versions the UK GHG Conversion Factors and pins a set to each reporting period stores every calculation run with a unique run ID and locks a closed period so a figure cannot move without a recorded restatement. Carbon data lineage records the chain from source file to activity record to factor set to result at entry level rather than at report level. Tenant allocation holds the apportionment rules in the same governed dataset as the recharge so a disputed line can be traced rather than defended in principle. Audit and assurance covers what goes into an evidence pack. The free Audit Readiness Check asks six questions about whether your carbon data would survive assurance.

The platform is built and operated under a certified information security management system [3]. It does not issue an assurance opinion it does not replace an assurance provider and a certificate over an information security management system is not a statement that any figure is correct.

Disclosure of interest. This paper is published by Sustainify AI. The analysis used the public sources and the method set out in the Method section and was carried out independently of the platform.

Limitations

The standard text is paywalled. The wording of control 8.15 was read from published implementation guidance rather than from the ISO file which is sold rather than published openly. The substance of the protection of logs guidance is consistent across the sources read but a reader quoting it in a contract should buy the standard.

ISO/IEC 27001 certification is not assurance over a number. The scope of registration on certificate 1N719TSI20261008GBRIS18Y covers the design development operation maintenance and support of digital platforms and related services [3]. None of the 93 Annex A controls addresses whether a conversion factor was applied correctly. Treating an information security certificate as evidence that a carbon figure is right is the specific overreach this paper is arguing against and it would be strange to commit it here.

The fraud data is not about carbon teams. The ACFE study covers investigated occupational fraud cases which are a selected population by definition. The percentages were read from the published concealment section of the 2026 report. They establish that concealment is normal in that population. They say nothing about the base rate of manipulation in sustainability reporting which nobody has measured.

The restatement study is US and covers corporate social responsibility reports. The 58% figure and the finding on assurance come from the abstract and extended data of the Nature Climate Change article [5]. The full text sits behind a subscription. The sample is major US public companies and not UK real estate so the direction is established and the size for a UK portfolio is not.

The worked example is invented. It shows the arithmetic of a factor set change and not a measured result for any portfolio. A portfolio with different consumption or a different mix would get a different answer and the point is the mechanism rather than the magnitude.

The audit inspection figures are from financial statement audits. The FRC inspects statutory audits. Sustainability assurance is inspected differently and the UK oversight regime for assurance providers was still being established at the time of writing. The comparison is a direction of travel and not a finding about sustainability assurance.

The regulatory positions are time sensitive. PS26/19 applies to accounting periods beginning on or after 1 January 2027 and the FCA has said it will keep the case for mandatory assurance under review [15]. The EU limited assurance standard is due by 1 July 2027 [16]. Both should be checked against the current position before anything in this section is relied on.

What not to conclude. None of this says that a spreadsheet based process is fraudulent or that an assured figure is unreliable. It says that a record which the producing team can edit does not answer the question an auditor is asking whatever software it sits in.