Audit Logs and Compliance: What Turkish Inspectors Look For in ERP Systems

When a Turkish tax inspector, KVKK auditor or external auditor reviews your ERP, they don't just look at financial statements — they look at the audit log. Who made which change, when, from where, with what justification. Foreign-owned subsidiaries often discover this only during an inspection, when missing or thin audit trails create trust problems that propagate into the inspection's tone and outcome. This guide explains what a serious audit log must capture and the six questions that surprise foreign-owned subsidiaries.

Note: Specific inspection procedures and statutory retention periods can change. Always confirm with your CPA and legal counsel for your exact situation.

Why audit logs matter beyond the obvious

Three forces converge on the audit log:

1. Tax compliance. Turkish tax inspections (VUK and KDV-driven) increasingly request the underlying ERP transaction history, not just the e-Defter and e-Fatura outputs. Inspectors want to see whether a transaction was edited after invoicing, whether VAT codes were retroactively changed, whether sequence integrity holds.

2. KVKK compliance. The Turkish Data Protection Authority's enforcement actions (especially after 2023) emphasise audit trails for personal-data access. Who looked at customer data, when, why. Without this trail, defending against a complaint becomes very difficult.

3. Independent audit. External auditors (Big Four and local firms) test ERP system controls explicitly. Audit log integrity is a control point; weak logs trigger additional substantive testing — increasing audit cost and management hassle.

What an audit log must capture

A serious ERP audit log records, for every transaction touching financial or personal data:

Who — user ID, role, organisational unit When — timestamp to second precision, ideally with timezone What — table/object affected, field-level before/after values From where — IP address, device fingerprint, session ID How — action type (create / update / delete / read for sensitive data) Why — for sensitive operations, a justification field

The log itself must be immutable — meaning the user cannot edit log entries even with admin privileges. Logs are typically stored in append-only tables with cryptographic chaining or written to separate immutable storage.

The 6 questions that surprise foreign-owned subsidiaries

1. "Show me all changes to the inventory revaluation entries from December." Inspectors will ask for retroactive changes to year-end inventory adjustments. If your ERP allows users to "fix" December entries in February without an audit trail, this is a serious control weakness.

2. "Who has accessed customer X's record in the last 90 days?" A KVKK complaint typically asks the company to demonstrate proper access controls. If the audit log doesn't track read operations on personal data, you can't answer.

3. "Has any transaction been booked outside its accounting period?" Cross-period postings (booking a January transaction in December) require justification. The log must show when the entry was made vs. when it was effective.

4. "What was the VAT rate used on this invoice in March vs. May?" If VAT rates changed mid-year (a common occurrence in Türkiye), the inspector wants to verify the right rate was applied for each transaction date — not retroactively corrected.

5. "Show me reversal entries for the past quarter and their original justifications." Reversal entries (özelge / iptal) are a legitimate accounting tool but inspectors examine them carefully for patterns suggesting profit manipulation.

6. "Who downloaded the customer database last month?" Bulk data exports of customer information should generate audit-log entries. Without this, you cannot defend against allegations of data leakage to competitors.

Retention periods

Common Turkish retention requirements (consult your CPA for exact numbers in your context):

Record Type	Minimum Retention
Tax records (VUK)	5 years (rolling)
e-Defter ledgers and beratlar	10 years
Personnel and payroll	10 years (some categories longer)
KVKK consent records	Duration of relationship + 6 months minimum
Customer contracts	10 years from contract end
Bank reconciliations	5 years
Audit log	At least equal to longest underlying record (typically 10 years)

The audit log must be retained as long as the underlying records. If you delete the audit log earlier, you've destroyed the evidence that the underlying records are reliable.

Common audit log weaknesses in ERP systems

1. Logs are admin-editable Easy fix in design but commonly overlooked. Logs must be append-only.

2. No log on read operations Many ERPs only log writes. KVKK requires read logging for sensitive data.

3. No justification field on sensitive operations "Why did you cancel this invoice?" — without a justification field, the answer is reconstructed months later from memory, which fails inspections.

4. Log retention shorter than data retention Logs deleted after 2 years while underlying tax data is retained for 5. Creates an inspection gap.

5. Logs not exportable in inspector-friendly format Inspectors expect CSV or PDF reports they can review. Raw database dumps aren't acceptable.

6. Logs not chronologically continuous Gaps in the log (e.g., during system downtime or migration) undermine credibility. If gaps exist, document them.

7. No integrity chaining Without cryptographic chaining (hash of previous entry included in next), an attacker who breaches the database can edit logs. Modern ERPs include this.

What to ask any candidate ERP

Before signing, run these tests:

• "Show me the audit trail for the last 5 changes to customer record X"
• "Demonstrate read-logging on a sensitive field"
• "What's your log retention policy and how is it enforced?"
• "How do you prove log integrity to an external auditor?"
• "What happens to the log during backup, restore and migration events?"
• "Can the system administrator delete log entries? Show me they cannot."

If any answer is hand-waved or "we have a separate document," that's a red flag.

Birasyo's audit log

Birasyo's audit-log architecture:

• Append-only log table with cryptographic chaining (hash-of-previous)
• Logs every write across all financial and personal-data tables
• Read-logging enabled on configurable sensitive fields (national ID, IBAN, health data, etc.)
• Justification field required for sensitive operations (deletion, retroactive period entries)
• Per-tenant log isolation
• Retention configurable from 5 to 25 years; default 10
• Inspector-friendly export: filtered CSV, PDF and XML formats
• Tamper-evidence: any attempt to modify a historical entry creates a flagged anomaly visible in admin dashboard

If you operate a Turkish entity and want a focused review of your audit-log readiness, book a session — we'll walk through your specific configuration and produce an inspection-readiness report.

Sources

• VUK (Vergi Usul Kanunu) — Tax Procedures Law
• KVKK (Law No. 6698) and KVKK Authority guidance
• ISO 27001 logging and monitoring requirements

Related reads:

• KVKK vs GDPR — ERP Compliance Cheat Sheet
• Setting Up a Türkiye Subsidiary: Day-1 Checklist
• Working with a Turkish CPA Inside Your ERP