By Louis Balla, Chief Revenue Officer, Nuage.
NetSuite shows who changed a field after a record was saved. System Notes record the date, who made the change, the context, the field, and the old and new values, while the Transaction Audit Trail and Login Audit Trail cover transactions and sign-ins. Reaching the data takes some navigation, and reviewing it at scale takes saved searches.
That navigation and search work matters more once AI tools or automation scripts have write access to your ERP, for example to post journal entries or update inspection records. Your audit trail then has to show who made each human change, and also who authorized each automated change, when it happened and whether it can be reversed.
If you are an IT leader or controller running automation inside NetSuite, the steps below show how to report on NetSuite’s native audit data and how to apply the same standard to changes an AI tool makes.
NetSuite Audit Trail vs. System Notes: What Gets Captured
“Audit trail” is often used as a blanket term, but NetSuite records changes in three separate places. Knowing which one to check saves time during month-end close or when an auditor asks for evidence.
System Notes: Your Field-Level Change Log
System Notes track many data and configuration changes. On a record, open System Information > System Notes (on transactions, the System Notes subtab). Each entry shows the date, who made the change, the context, the type of change, the field, and the old and new values. A Field dropdown on the subtab filters the list to one field. Scrolling through a long list of field changes on a single record is slow, which is why Step 3 builds a saved search.
Transaction Audit Trail and Login Audit Trail
The Transaction Audit Trail is a report of what happened to transactions: it shows when a user created, changed or deleted one, along with the user, role, date and time, and the amount. It lives at Transactions > Management > View Audit Trail. This report supports SOX compliance and lets a controller show that journal entries were not modified after approval. The Login Audit Trail, at Setup > Users/Roles > View Login Audit Trail, tracks sign-ins: who logged in, when, and from which IP address.
Your NetSuite access controls checklist should reference System Notes and both audit trails. Our NetSuite SOX compliance guide shows how auditors use them.
Step-by-Step: How to Find and Use NetSuite Audit Trail Data
When an auditor asks for evidence, or when you need to investigate an exception during close, these four steps get you from the log to a report.
Step 1. Verify Role Permissions for Audit Trail Access
Not every role can see audit data. By default, the Transaction Audit Trail is available to the CEO, CEO (Hands Off), CFO and Support Administrator roles, and other roles need the audit trail permission. The Login Audit Trail needs the View Login Audit Trail permission, which the Administrator role has by default. Go to Setup > Users/Roles > Manage Roles to see which roles hold these permissions, and keep edit access tight.
Step 2. Access System Notes on Individual Records
Open any transaction or record and go to its System Notes, which list each logged change by date. For a quick investigation, such as finding out why a record changed after sign-off, start here and filter by field if the list is long.
System Notes also show how a change was made. They include a Context column, and Oracle lists the user interface, web services and SuiteScript as different contexts. The section on AI below uses that separation.
Step 3. Build Saved Searches for Audit Reporting at Scale
To review all changes to one field across hundreds of records, or every manual override during a close period, use a saved search.
Start at Reports > New Search > System Note. Add criteria for the user, role, date range, type of change, field, old and new values, or context. Common result columns are the date, who made the change, the field, the old and new values, and the context. A saved search can email its results to a reviewer, so set one up to run at the end of each close cycle and keep the output as the evidence you hand your auditor.
If you have SuiteAnalytics access, you can build more advanced reports on top of the same data. Nuage’s Stratus team holds Oracle NetSuite certifications including SuiteFoundation and SuiteAnalytics User, and we build this reporting for controllers who want audit evidence that comes straight from NetSuite.
Step 4. Set Up Email Reports for High-Risk Changes
Because a saved search can email its results, you can set up a standing report for specific conditions: changes made outside business hours, a value modified after an approval was granted, or a manual change in the user interface on a field that automation normally sets. With these reports in place, someone reviews high-risk changes on a schedule.
Extending the Audit Trail Standard to AI and Automation
When an AI tool generates a journal entry or fills in inspection results, the same compliance standard applies as for a person, and the controls have to be set up deliberately.
Identify Every Automated Touchpoint
Map every point where an AI tool or automation script creates or changes a NetSuite record, including integrations, scheduled scripts, API calls from external AI services and workflow-triggered updates. Each of those needs to show up in the audit trail.
AI governance in an ERP context comes down to answering the same questions for an automated process that you answer for a person: who authorized this change, what was the change, when did it happen, and can it be reversed? When you build automation workflows in NetSuite, build the audit evidence into the design from the start.
Give Every Automated Process Its Own Identity
Set up a distinct integration user, and a distinct script deployment, for each AI-driven process, so that the person reading System Notes can tell one process from another. With one shared “admin” login for three integrations, your auditor cannot tell which integration made a change. Then use the Context filter in your saved searches to separate changes made through web services or SuiteScript from changes made in the user interface. Our Claude connector setup guide covers how roles limit what a connected AI tool can see and do.
Maintain Approval Controls for AI-Generated Changes
An AI tool that posts a journal entry without an approval step is a control gap. The approval and sign-off process that applies to human-initiated transactions needs to apply to automated ones, and in many cases it should be stricter, because an AI tool can post changes faster than anyone reviews them.
Require a person’s review for AI-generated transactions above a defined threshold. Below that threshold, automated approvals are acceptable as long as the audit trail captures the approval logic and the exception criteria.
Buyers raise the same question. A finance leader at a software company that already uses AI agents for spreadsheet work wanted those agents to upload journal entries, and named the open question: “it’s the same issue we’re dealing with on all our agent and AI work is how do we build in the approval, the reviews.” At a flow-control manufacturer, the finance team said IT would not connect an AI tool to NetSuite “until we fix and are comfortable with our role and permission structure.”
NetSuite features that flag a transaction and leave the decision with a person fit that standard. Oracle describes NetSuite’s exception management as a machine learning feature that highlights unusual or missing transactions for review before period close.
Checking AI-Drafted Work Before It Reaches a Client
We apply the standard this article describes to our own AI-assisted work. Our consultants use Claude to draft the first version of a NetSuite environment assessment. Claude reads the client’s discovery notes, or for an existing client its ticket history and call transcripts, and queries the live account through a role and service account that the client’s NetSuite administrator creates.
Items in the draft are tagged by where they came from. A live query outranks the ticket history, and the ticket history outranks anything inferred from a call. A problem found in old tickets stays a candidate until a live query shows it still exists, and anything Claude cannot confirm goes to the client as a question for the intake or review meeting.
Before the assessment runs, the consultant makes five checks on the connection. A role limited to one subsidiary, or without administration access, sees only part of the account, so a partial result can look complete. If the role fails either of those checks, we discard everything gathered under that role and collect it again once the role is fixed.
A consultant then reviews the draft before anything goes to the client, checking:
- whether the summary matches the discovery notes
- whether each severity rating can be defended
- whether each open item is a real gap or something Claude could have found with a query
Findings are registered as tickets in the client’s project, and status changes are recorded on each ticket, so the ticket history is the audit trail for the work. From July through September 2026, our team logged 288 finding tickets across 15 client accounts.
In one 2026 assessment, a quick count in the client’s sandbox during a call found slightly under 300 project tasks with a blank service item, a problem the client dated to around April. Claude’s query of the live account found a field with that name blank on more than 99 percent of about 14,500 tasks, with no meaningful change around April. A field blank almost everywhere does not fit a problem that started recently, so we recorded that it is probably not the field the client meant. The finding stays open until we identify the right field with them.
What Untraceable Changes Look Like
Here is what gaps in the trail looked like at two clients. At a materials company, the CFO twice found permission or script changes during his own quarterly access review that had no ticket or approval behind them, so we recommended that every permission and script change be linked to an approved ticket. At an aerospace company, a vendor bill had been edited to show a corrected payment instead of being reversed and rebooked, which erased the record of the original payment attempt and left two refund wires with nothing to offset. System notes confirmed the bill was changed, and we opened a separate ticket to trace it.
A Practical Audit Readiness Checklist for AI-Enabled NetSuite Environments
Use this as a quarterly review, or run through it before any new AI tool or automation goes into production.
- Confirm which roles can view the Transaction Audit Trail, the Login Audit Trail and System Notes searches. Document who has access and review quarterly.
- Verify every automation and AI integration uses its own integration user and script deployment.
- Build saved searches that capture field-level changes for high-risk record types: financial transactions, inventory records, inspection results, approval fields.
- Email standing reports for changes outside normal parameters: off-hours changes, post-approval edits, bulk updates from a single process.
- Document approval workflows for AI-generated transactions, including thresholds, escalation paths, and the logic for automated approvals.
- Run a test audit quarterly. Pull a sample of AI-generated changes and trace each one from trigger to System Notes entry to approval record. Treat any change you cannot trace as a gap to close.
- Archive saved search results so you can hand your auditor a report.
Frequently Asked Questions
How do I create an audit trail for AI-generated changes in NetSuite?
Give each AI-driven process its own integration user, so System Notes show which process changed a record. Filter a saved System Note search on context to separate web services and SuiteScript changes from user interface edits. Then add an approval step above a set threshold and record the approval logic, so each change traces to an authorization.
How long should we retain audit evidence extracted from NetSuite for audits and internal investigations?
Align retention with your regulatory and contractual requirements and your internal risk policy. Many teams keep audit extracts for multiple years. Store exports in a controlled repository with access logging, and document the retention schedule so it is repeatable across audit cycles. Oracle’s documentation says System Notes for an existing record are deleted only when the record is deleted, so keep extracts for records you may delete.
How can we prove an AI driven change originated from a specific source system or model run?
Add a correlation ID to every automated transaction, then carry that ID through the integration payload, NetSuite record fields, and external system logs. This lets you tie a System Notes entry back to the exact upstream request, prompt, job, or pipeline execution.
How do we handle auditability when integrations use shared credentials or rotating API tokens?
Give each process its own service account, and rotate secrets without changing the account that writes to NetSuite. If token rotation is required, log each token issued and map it to the same integration user, so the same actor appears in the evidence before and after rotation.
When an auditor requests evidence, what is the most defensible way to package NetSuite audit data?
Provide a scoped report with clear filters, time window, and field definitions, plus a brief data dictionary describing each column and how it is generated. Include access controls around the file and a documented chain of custody showing who produced it and when.
Hold AI Changes to the Same Audit Trail
Each change, whether a person or an AI tool made it, should leave a record of who or what made it, when, and under whose authorization.
If you are running automation in NetSuite and are not sure your audit trail is complete, start with the saved search in Step 3, which shows your System Notes data at scale and where the gaps are. Our team helps manufacturers and distributors govern automation in NetSuite. Schedule a discovery call and bring your compliance requirements to the conversation.
About the author
Louis Balla is Chief Revenue Officer at Nuage, a NetSuite optimization partner that has served 250+ clients since 2011 and holds a 4.9 out of 5 rating on Clutch. The client work in this article is our team’s.
