> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/caddie/item-audit-trail.md).
# Audit trail for a review item
The History column on the reviewer's tables and the audit trail sheet it opens — everything already recorded against one review item, who may open it, every event it can show, what it deliberately doe
Every review line accumulates a history. It is generated, routed to a reviewer, opened, sometimes delegated, escalated or reassigned, sometimes auto-certified and later un-auto-certified, sometimes asked about, and eventually decided. OpenIAM has always recorded all of it. Until now none of it was visible for a single item in the reviewer interface, so *what has already happened to this line?* was answered by reading the database. The **History** column answers it in the product.
This page is for reviewers, campaign managers and auditors alike. The trail is not part of Caddie — Access Review Assistant and is not a beta feature: every campaign has it, because every reviewer asks this question.
**On this page**
* [Where it is](#audit-history-column)
* [Who can open it](#audit-who-can-open)
* [What the sheet shows](#audit-sheet) · [Reading one card](#audit-card)
* [The events that can appear](#audit-events)
* [What it deliberately does not claim](#audit-silences)
* [What it cannot change](#audit-read-only)
* [Contacting the campaign managers](#managers-item)
## Where it is
Both reviewer drill-down tables carry a narrow **History** column, between the risk columns and the **Decision** column:
* the entitlements listed under one user;
* the users listed under one entitlement.
Every row has it, decided or not, whatever the campaign's settings. Its clock button carries the tooltip *View review history for this item* and opens a right-hand sheet titled **Audit trail for this item**, subtitled with the entitlement, its application and the reviewed person: *Payments-Admin · Payments — Tom Becker*.
{% hint style="info" %}
Unlike the Caddie blocks, the History column does not depend on **Enable Beta Features** or **Enable Caddie — Access Review Assistant**. It is present in every campaign and on every row, including rows already decided and rows waiting for another reviewer's step.
{% endhint %}
## Who can open it
The same people who may work on the item:
* a global access certification administrator;
* a manager of that campaign;
* the reviewer the item is currently routed to;
* anyone who has already recorded a decision on it.
Asking for help about an item does **not** by itself grant this access. Otherwise asking one question would buy permanent visibility of an item the person was never entitled to review.
## What the sheet shows
The events are listed **oldest first**, so the sheet reads as the story of the line rather than as a log tail: generated, opened, reassigned, asked about, decided. While it loads, the sheet reads *Loading the audit trail...*; if it cannot load, *The audit trail could not be loaded.* with a **Retry** button. An item that nothing has happened to yet says so, *Nothing has happened to this item yet.*, rather than showing an empty list.
The sheet is fetched when it opens and reused for fifteen seconds, deliberately shorter than the other reviewer caches: your own decision appends to this trail, and a stale answer here is one that omits what you just did.
### Reading one card
Each event is one card:
| Part | What it is |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Status chip | What kind of event it was: `PENDING`, `IN PROGRESS`, `CERTIFIED`, `REVOKED`, `REVIEWED`, `AUTO-CERTIFIED`, `DELEGATED`, `ESCALATED`, `REASSIGNED`, `WITHDRAWN`, `HELP REQUESTED`, `REJECTED`, `UNANSWERED`, `CANCELED`, or `RECORDED` for anything the sheet does not recognise. Coloured by tone: red for a revocation or rejection, green for a certification, amber for an escalation, reassignment or withdrawal, blue for a delegation or a help request, grey for the rest |
| Timestamp | The date and time it was recorded |
| Name | The person it is attributed to, or **Certification Engine** for the events the platform records itself |
| Address and role | The person's email address, and how they came to be a reviewer: *manager*, *application owner*, *entitlement owner*, *campaign manager*, *reviewer*, and so on |
| Sentence | One plain line saying what happened |
| Note | The reviewer's own comment, when they left one |
| Step | Which of the campaign's reviewer steps the event belongs to and what kind of reviewer that step is for, *Step 2 of 3 · application owner*. Omitted when the event belongs to no step, or to one the campaign no longer has |
## The events that can appear
| Chip | Sentence | What it means |
| ---------------- | ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `PENDING` | *Item generated and assigned to the first reviewer step.* | The campaign launch created the line |
| `IN PROGRESS` | *Item opened for review.* | A reviewer opened it |
| `CERTIFIED` | *Access certified.* | A reviewer kept the access. When it was part of a bulk action the sentence adds *Decided as part of a bulk action.* |
| `REVOKED` | *Access revoked.* | A reviewer removed the access, with the same bulk suffix where it applies |
| `REVIEWED` | *Review step completed.* | A step finished, in a case where the decision cannot be attributed to that one reviewer; see [below](#audit-silences) |
| `AUTO-CERTIFIED` | *Automatically certified by policy.* | The campaign's automation rule certified it without a person |
| `WITHDRAWN` | *Pre-approval withdrawn; the item went back to its reviewer.* | A later risk re-evaluation took that auto-certification back |
| `DELEGATED` | *Delegated to another reviewer.* | The reviewer handed the item to somebody else |
| `ESCALATED` | *Escalated to the next reviewer.* | The item went up the escalation chain |
| `REASSIGNED` | *Reviewer changed after an organisational move.* | The reviewer changed, typically because the reviewed person's manager changed |
| `REJECTED` | *Review step rejected.* | The step was rejected |
| `HELP REQUESTED` | *Help requested from the entitlement owner (2 recipients).* | The reviewer wrote to a helper through [Ask for help](/administration-guide/caddie/ask-for-help.md). A request that never reached the mail service adds *The message could not be sent.* |
| `UNANSWERED` | *The reviewer's step closed without an answer.* | The step ended with no decision |
| `CANCELED` | *Review canceled.* or *Review canceled because it expired.* | The review was canceled, including by the expiration policy |
| `RECORDED` | *Recorded against this item.* | An event this release does not know how to word |
## What it deliberately does not claim
Two silences are intentional.
**An outcome is only named when it belongs to that reviewer.** A certification and a revocation are recorded identically in the audit table; the outcome lives on the item, not on the row. So the sheet says *certified* or *revoked* only where the stored data settles it beyond doubt: the revoker the item names, an auto-certification, and a completed step on an item that ended certified with nothing revoked. In a multi-step review where an early approver's step was later overridden by a revocation, that early card says the neutral *Review step completed* rather than crediting them with a decision the item did not end up taking.
**A help request records the handover, not the delivery.** The trail says how many people were asked and what kind of helper they were, never who, and never the message body, which would turn the certification record into a mail archive. A failure is reported as *could not be sent*, because reaching the mail service is the last thing OpenIAM can actually observe.
## What it cannot change
The sheet is read-only throughout. It records nothing of its own, it cannot edit or delete an audit row, and it offers no decision and no recommendation. The certify and revoke toggle stays on the row where it always was. The same events, for every item of a campaign at once, are in the campaign's evidence; see [Campaign history and evidence](/administration-guide/governance/certification/campaign-history-and-evidence.md).
## Contacting the campaign managers
Reviewers who get stuck on a line need to know who actually runs the campaign, and the campaign's managers were only ever an id list nobody could read. The header of every campaign review screen now carries a **Campaign managers** item, beside the start and due dates. Opening it lists each manager's name, email address and phone number, with the address and number as clickable mail and telephone links.
Only the details actually recorded on a manager's profile appear. A manager with neither an email address nor a phone number is listed by name with *No contact details recorded.*, rather than as a blank row; a campaign with no managers reads *This campaign has no managers assigned.* The lookup runs the first time the item is opened, never on page load.
The list is readable by campaign administrators and by any reviewer with at least one item in the campaign, current or already decided. It is read-only: managers are added and removed on the campaign dashboard in the Webconsole, never from the reviewer's header. See [Operate a live campaign](/administration-guide/governance/certification/operate-a-live-campaign.md).
## Related
* [Ask for help](/administration-guide/caddie/ask-for-help.md) — the one reviewer action that adds an event to this trail
* [Campaign history and evidence](/administration-guide/governance/certification/campaign-history-and-evidence.md) — the same events across a whole campaign, for the auditor
* [Configure the review workflow](/administration-guide/governance/certification/configure-the-review-workflow.md) — the steps, escalations and expiration policy whose events appear here
* [Certification database tables](/administration-guide/reference/certification-tables.md) — the `ACCESS_REVIEW_ITEM_AUDIT` table the sheet reads
*Applies to OpenIAM 2026.9.2. Last reviewed 23 September 2026.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.openiam.com/administration-guide/caddie/item-audit-trail.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.