In plain English
A contract audit trail is the attributable record of who proposed, accepted, and signed each material change, not a folder of emails named FINAL. Immutable versions and named authors let you answer “who agreed to this clause?” in diligence, a dispute, or a renewal. If history can be silently overwritten, it is not an audit trail.
Not legal advice. Audit trails support operations and evidence hygiene; they do not create privilege or decide a dispute. Escalate when a claim, investigation, or financing data room is live.
By version90 staff Published Updated How this was made
What is a contract audit trail?
It is the answer key for four questions:
- What text was live on a given date?
- Who proposed a material change (and in which round)?
- Who accepted it: counterparty markup, your version owner, a signer?
- What was executed, and how does it relate to the last redline?
That is narrower than full contract lifecycle management, and stricter than a shared drive. Folders store files. Audit trails store attribution. If you cannot tell "Alex accepted their liability redline Thursday" from "someone dropped a clean PDF Friday," you have folklore. Folklore fails in diligence.
Why is “who agreed to this clause?” the question that shows up late?
Because nobody asks it while the deal is fun. They ask when buyer’s counsel wants a witness on indemnity, a customer denies auto-renew (check the notice window and the round that added it), finance bills the wrong MSA version, or you cannot remember whether a cap carve-out was a concession or a typo.
Email is a copy machine. Track Changes helps only if you kept the file (Word tracked changes negotiation). Clean copies without history are how "we all agreed" becomes a group hallucination.
What does attribution actually require?
Attribution is not a personality. It is metadata you can point at.
| Need | Bare minimum | Better |
|---|---|---|
| Identity | Distinct Word author names (not three people as "Admin") | Named users; no shared contracts@ login for markup |
| Time | Round dates in filenames or emails | Immutable timestamps per version |
| Action | Tracked insert/delete vs comment vs "accept" | Clear accept/reject pass by a version owner |
| Object | One canonical .docx per deal |
Version IDs that emails can cite |
| Execution | Signed PDF | E-sign certificate + freeze note (e-signature and redline workflow) |
| Intent | Cover email summarizing open issues | Internal notes kept off the send file (internal notes vs counterparty comments) |
Shared logins destroy attribution. If the whole company redlines as one seat, "who agreed" becomes "the company, allegedly." Unlimited seats exist so humans can be humans. Use them.
Why must versions be immutable?
Because an audit trail that can be edited after the fact is a diary, and diaries get rewritten when people get embarrassed.
Immutable means:
- Old versions remain retrievable.
- New work appends; it does not silently replace Tuesday.
- The executed artifact cannot be swapped for a "cleaned up" cousin without a new record.
Overwriting Acme-MSA.docx in place is how you lose the concession you need to explain. Contract version control is the habit; immutability makes it trustworthy.
If someone can delete the awkward round, you will discover that talent on the worst day of the quarter.
How do you capture agreement, not just edits?
Edits show what moved. Agreement is a decision.
Practical capture, startup-scale:
- Tracked changes on for every external round. Off is how silent fee edits land.
- Accept/reject as a dedicated pass, with a named owner, not while rewriting scope.
- Cover emails that say the thing: "We accept your §4 redline; we counter §9 as marked." That sentence is gold six months later.
- Freeze before sign. Generate the packet from the canonical file. Store last redline + executed PDF + certificate.
- Deviation log for checklist misses: "Accepted their one-way assignment; owner = founder; date = …" A spreadsheet beats a vibe.
AI can help if findings attach to a specific version and cite clauses (AI contract review with citations). A chatbot summary with no pin to a hash or version ID is not a trail. It is a vibe in a trench coat.
Audit-trail checklist
- Canonical file identified; prior rounds retained (not "cleaned up")
- Authors are real people; no shared markup identity
- Each send/receive is a version, not an overwrite
- Comments intended for the counterparty only in the send file
- Cover email or issue list stored with the round
- Accept/reject pass attributed to the version owner
- Execution packet generated from the freeze; binaries match
- E-sign completion record stored beside the last redline
- Material deviations from playbook written down with an owner
- History cannot be silently deleted by the intern with good intentions
Skip the list and you can still close. You just cannot explain it. That bill arrives later.
When is a folder enough vs when do you need software?
A disciplined folder plus Track Changes can work at very low volume if a version owner is religious and nobody overwrites.
Upgrade when:
- Two people negotiate in parallel and you cannot answer "what's live?" in a minute.
- Diligence or enterprise customers ask for version history as a security/process question.
- You want AI review pinned to the file that actually shipped.
- You are tired of reconstructing intent from Gmail search.
You still may not need enterprise CLM (SMB vs enterprise). You need Word-native history that does not lie.
About this page
Who. Written by version90 staff at Latent Ape LLC, the company that builds version90, working with AI tools. We build contract software and run our own contracts through it; we are not a law firm, and nothing here is legal advice.
How. Each piece starts from the review workflow version90 is built around. AI drafts and structures the text; staff edit, fact-check, and rewrite it before it is published, and we update the date shown above whenever the substance changes.
Why. The library exists to give founders and ops teams a shared standard for reviewing contracts without a legal department. If you spot an error, email [email protected] and we will fix the page.