This page is for auditors, controllers and the people who answer their questions. It lists the evidence that each Compliance app produces, where you find it in Business Central and which page explains it. It also says what the evidence does not prove.
| The auditor asks | Evidence | App | Where |
|---|---|---|---|
| Who changed this permission set, and when? | Every change with user, time and the permissions before and after. | Advanced Permissions Management | Change history |
| What changed in a given period? | The Change Explorer filtered by period, with Changed By. | Advanced Permissions Management | Reviewing changes |
| Did an app update change permissions? | Entries with Changed By App Update. | Advanced Permissions Management | App updates |
| Did anyone look at the changes? What did they conclude? | A completed review: each change is Reviewed or Flagged, with a comment. | Advanced Permissions Management | Reviewing changes |
| Are permission sets free of risky patterns? | A quality check with findings per set: Info, Warning or Critical. | Advanced Permissions Management | Quality checks |
| Which users can change this field? | The Field Security, its linked permission sets and the effective security per user. | Field Security | Effective security |
| Who changed the security rule itself? | The change log entries of the Field Security or Filter Security. | Field Security | Securing fields |
| Does the system enforce this data rule? | The validation, its results page and the list of records that break it (Check Table). | Field Validation | Creating validations |
| Does inventory agree with the general ledger? | A reconciliation per account with the difference explained. | Inventory Reconciliation | Reconcile inventory accounts |
| What is the basis of this permission set? | A recording of the permissions a task used. | Advanced Permissions Recorder | Record permissions |
Business Central logs changes to permission sets you created. It does not log changes to system permission sets, for example by an app update. Advanced Permissions Management records both.
The recording shows which objects and permissions a task used. Use it as the basis of a permission set. It is not an audit trail of users over time.
The change log entries and permission data can be read through web services for the Authorization Box. See Web services.
Last reviewed: October 2026.