Audit
Reading the record
What is written for every action, and how to answer the question a director will actually ask.
Four things are written for everything a worker does: what happened, who authorised it, when, and what the worker was not permitted to do at that moment.
The fourth field is the one people do not expect and the one auditors care about. Knowing what a worker did is useful. Knowing the boundary that was in force when it did it is what lets somebody reconstruct whether the control was adequate.
The test to hold this against: a director can ask what a worker did last Tuesday, who approved it, and what it was not allowed to touch, and get an answer.