The auditor arrives. They request the modification history of a journal entry from the previous quarter. Your team spends three days reconstructing it manually. That scene, repeated across dozens of mid-sized companies in LATAM, has a solution inside Business Central — but only if the audit is configured before the auditor shows up, not after.
This article is a practical guide on how to activate and govern Business Central audit to comply with IFRS, LGPD and local regulations in each country without turning the ERP into a slow system that holds back your operations team. At KCP Dynamics we apply this with real clients in manufacturing, financial services and retail — and the patterns we’ve seen are always the same.
Why traceability is no longer optional in LATAM
For years, regulatory compliance in the region was managed with spreadsheets, emails and goodwill. That time is over. Brazil’s LGPD, Colombia’s Law 1581, Mexico’s Fintech Law and the IFRS requirements in force throughout the region require companies to demonstrate, with verifiable records, who accessed what data, when and with what authorization. The audit trail generated by Business Central directly addresses that requirement with native tools that produce that evidence automatically.
The problem is not the willingness to comply. The problem is that many ERP systems from previous generations were not designed to generate that evidence automatically. The finance team ends up building the audit trail after the fact — and that, in a serious inspection, convinces no one. That is why Business Central audit is gaining ground as a standard in the region.
IFRS requires traceability over the recognition, measurement and presentation of financial information. That means being able to answer, for any transaction, four questions: who recorded it?, when?, what value did it have before the change?, what approval supported it? The internal control features that Business Central offers determine how easily the finance area can explain who changed what, when and why. If that answer takes days, the problem is not the auditor — it is the system configuration. A properly implemented Business Central audit eliminates that problem at the root.
For companies with subsidiaries in the United States or that are listed on regulated markets, the SOX (Sarbanes-Oxley) framework adds an additional layer: it requires documented controls over the integrity of financial information and the segregation of duties between the person who records, the person who approves and the person who reviews. Business Central allows implementing that separation through granular security roles and native approval workflows, leaving a traceable audit trail at every step.
The three layers of native audit in Business Central
Business Central is not a passive audit system. The Change Log records changes in specific tables and provides a complete audit trail that improves transparency and accountability within the organization. But the Change Log is only one of the three available layers of Business Central audit. Understanding them separately is key to configuring correctly without overloading the system.
Change Log: the granular change record
The Change Log is the most powerful tool for financial Business Central audit. It allows activating logging at the table and field level: you can decide that all changes to the vendor table are recorded, but only the bank account field and the payment terms field. When Business Central audit is activated by entity, Dynamics 365 begins tracking changes at the record level; by default, all fields are included. In Business Central, that granularity is configurable field by field.
The result is a log that shows the previous value, the new value, the user who made the change and the exact timestamp. That is exactly what an external auditor needs to see to validate the integrity of financial data under IFRS. The Business Central audit turns that validation into a traceable and reproducible process — the core of any robust internal control system.
Field Monitoring: real-time alerts on critical fields
The Field Monitoring goes one step further within the Business Central audit: it not only records the change, but triggers an immediate notification when someone modifies a field marked as sensitive. Functional exchange rate, accounting account of an asset, conditions of a lease contract under IFRS 16 — any modification generates an alert to the compliance officer before the closing cycle advances.
Over time, the list of entries in the monitored fields log grows; to reduce the volume of entries in the Business Central audit, retention policies can be created that delete records after a defined period. Configuring those policies from the start avoids the most common problem we see in production: databases that grow uncontrollably and start to affect query performance.
Activity Log: visibility over user access and sessions
The Activity Log records the activity of users and administrators at the session level within the Business Central audit. When activity logging is enabled, user and administrator activity is recorded in the Purview audit log, where it can be retained for 90 days or more depending on the license; this allows compliance teams to search for specific activities across the entire Microsoft 365 ecosystem.
For companies operating under LGPD or equivalent data protection regulations, this layer of the Business Central audit is especially relevant: it demonstrates who accessed personal data of customers or employees, for how long and from what environment. It is the difference between responding to an authority request in hours or in weeks. Applying the principle of least privilege — giving each user access only to the data they need for their role — drastically reduces the risk surface and simplifies the review of the Activity Log when an inspection arrives.
How to map each regulation to the correct configuration
The most frequent mistake we find in implementation projects is activating the Change Log on all tables without criteria. The result: the system slows down, the log fills with noise and nobody reviews it. Business Central audit works when it is aligned with specific regulatory requirements, not when it is activated by default on everything. A well-designed Business Central audit always starts from the regulatory framework applicable to each organization.
| Regulation | What it requires | Recommended BC tool |
|---|---|---|
| IFRS | Traceability of financial recognition and measurement | Change Log on financial tables + workflow approvals |
| LGPD (Brazil) | Record of access to personal data and legal basis for processing | Activity Log + data classification + retention policies |
| Law 1581 Colombia / Habeas Data | Consent and traceability of data subject usage | Activity Log + granular security roles |
| SOX (U.S. subsidiaries) | Segregation of duties and documented internal control | Security roles + Workflow Approvals + Change Log on financial tables |
| Local tax regulations (DR, MX, PE) | Integrity of tax documents and electronic invoicing | LATAM localization + Change Log on sales and purchase tables |
Depending on the industry, markets and geographic location, an organization may be subject to local accounting principles and international standards such as IAS/IFRS, which establish criteria for recognition, measurement, consolidation and presentation. Business Central audit is designed to support that regulatory overlap — but the mapping between standard and configuration requires judgment, not just flipping switches.
A detail that makes a difference before the Brazilian ANPD (Autoridade Nacional de Proteção de Dados): Resolution CD/ANPD 19/2024 on international data transfers establishes that both the controller and the processor are responsible for documenting the processing and its compliance with the LGPD. That means traceability cannot be delegated to the software provider — it must be configured and governed within the organization’s ERP. Business Central audit provides the technical framework to meet that requirement in a verifiable way.
Step-by-step configuration of the Change Log in Business Central
Describing what the Change Log does is useful. Knowing how to activate it in five minutes is what turns this article into an executable resource. The path is straightforward and requires no additional development: it is native configuration of Business Central audit.
Steps to activate the Change Log
- Access Change Log Setup — In the Business Central search bar (shortcut Alt+Q), type “Change Log Setup” and open the page. Here you will find the main switch to activate or deactivate the log globally. Every time someone activates or deactivates the log, that action is automatically recorded in the Business Central audit.
- Define the tables to monitor — Within the same page, select Setup → Tables. The list of BC tables appears. For each table you can configure three events: Log Insertion, Log Modification and Log Deletion. Each event accepts three values: None, Some Fields or All Fields.
- Select specific fields when choosing “Some Fields” — By marking Some Fields in Log Modification, a detail button appears that lets you choose exactly which fields to record. This is the recommended configuration for high-volume tables such as Customers or Vendors: monitoring only the risk fields (bank account, payment terms, credit limit) prevents uncontrolled log growth.
- Restart the session for changes to take effect — New Business Central audit records only appear in Change Log Entries after the user logs out and back in, or switches company within BC.
- Review records in Change Log Entries — Search for “Change Log Entries” in the search bar. From there you can filter by table, field, user or date range. The native Data Analysis feature allows building interactive views of the “who changed what and when” type without exporting to Excel.
| Table | Recommended event | Key fields to monitor |
|---|---|---|
| Chart of Accounts (Table 15) | Modification + Deletion | Account Type, Posting Group |
| Vendors (Table 23) | Modification (some fields) | Bank Account, Payment Terms, Posting Group |
| Customers (Table 18) | Modification (some fields) + Deletion | Credit Limit, Payment Terms, Personal Data |
| Exchange Rates (Table 330) | Insertion + Modification | Relational Exchange Rate, Starting Date |
| VAT Setup (Table 325) | Modification + Deletion | VAT %, Sales/Purchase VAT Account |
| General Journals (Table 81) | Modification | Amount, Account No., Description |
Audit in multi-company environments: the case of LATAM groups
A critical gap that the original post did not cover and that appears in almost all business groups in the region: how does Business Central audit work when there are several legal entities operating in the same tenant?
The short answer is that the Change Log operates independently for each company in Business Central. Each legal entity has its own Change Log Setup, its own configured tables and its own records in Change Log Entries. There is no native consolidated view of logs across companies — if you need to review changes in five subsidiaries simultaneously, you have to access each company separately or export the logs to an external tool.
This has direct implications for the internal control of business groups:
- Audit configuration is not automatically replicated across companies. If you define the table scope in the parent company, you must replicate that configuration manually in each subsidiary — or through managed configuration scripts.
- For consolidated visibility, the most robust option is to export the logs from each company to Microsoft Purview or a centralized SIEM tool, where compliance teams can perform cross-searches. Business Central allows this export natively.
- Financial consolidation (BC’s native module) transfers journal entries between companies, but not the audit logs: the audit trail of each transaction remains in the source company. An auditor who needs full traceability must access the source entity, not the consolidated one.
At KCP Dynamics, when we implement Business Central audit in groups with three or more legal entities, we establish from the design phase a documented standard configuration policy that is deployed across all companies, plus a quarterly cross-review calendar. That standardization is what allows responding to an external auditor consistently, regardless of which subsidiary is under inspection.
The performance problem: how to audit without slowing down
Here is the real tension that nobody mentions in the brochures: activating Business Central audit has a computational cost. Every write to the log is an additional operation on the database. If you activate the Change Log on 40 tables with all fields, in a company with 500 daily transactions, the log volume can exceed the IT team’s management capacity within weeks.
At KCP Dynamics we apply a principle of risk-based selective audit within the Business Central audit: the Change Log is activated only on tables that have a direct impact on financial statements, personal data or tax documents. Everything else is managed with process controls (approvals, workflows) that leave their own trace without generating load on the log.
The tables that almost always fall within the priority Business Central audit scope are: chart of accounts, general journals, vendors, customers, payment terms, exchange rates and VAT setup. Everything else is a candidate for case-by-case review, depending on the sector and the client’s regulatory framework.
Retention policies: the balance between compliance and performance
Log retention is another critical point in any Business Central audit. IFRS does not specify a single retention period for electronic evidence, but local tax regulations in countries such as Mexico, Peru or Colombia require keeping accounting documentation for between five and ten years. Business Central allows defining automatic retention policies that archive or delete log entries according to configurable rules.
The approach we recommend at KCP Dynamics: active retention of 24 months in the system, with automated export to external storage (Azure Blob Storage or Microsoft Purview) for the remaining period to meet the legal deadline. Business Central audit and Dynamics 365 include log export capabilities that allow extracting data for external review, long-term storage or integration with third-party compliance tools; logs can also be sent to Microsoft Purview or a SIEM application for centralized monitoring.
When native tools are sufficient — and when they are not
A legitimate question that any honest implementer asks: at what point do the native Business Central audit tools fall short and you need an AppSource add-on or an ISV solution?
- Native tools are sufficient for most mid-sized companies in LATAM that need to comply with IFRS, LGPD and local tax regulations. Change Log + Field Monitoring + Activity Log cover 80% of typical regulatory requirements at no additional license cost.
- Consider third-party solutions when you need: pre-formatted audit reports for specific regulators (for example, Mexico’s CNBV or Colombia’s SFC), approval workflows more complex than BC’s native ones, or integration with external GRC (Governance, Risk & Compliance) platforms.
- The Activity Log with extended retention in Purview depends on additional Microsoft 365 licenses (Microsoft 365 E3 or higher for 90-day retention; E5 or Compliance Add-on for up to 10 years). This licensing cost must be evaluated in the design phase, not after go-live. Incorporating it from the start is part of a sustainable Business Central audit strategy.
Audit governance: who configures, who reviews, who approves
Technology solves half the problem. The other half is organizational. In 80% of projects where the audit fails, the system was well configured — but nobody had been assigned the responsibility of reviewing it. The log existed; nobody read it. This applies equally to any Business Central audit, regardless of the size of the organization.
The three roles of the governance model
An effective governance model for Business Central audit has three differentiated roles, which embody the segregation of duties required by both SOX frameworks and internal control best practices:
- Configuration owner (IT/ERP Admin): defines which tables and fields are audited in the Business Central audit, manages retention policies and reviews the performance impact monthly.
- Compliance reviewer (Finance/Legal): accesses the Business Central audit Change Log for periodic reviews and in response to external requests; validates that the configuration covers the applicable regulatory frameworks.
- Sensitive change approver (CFO or Controller): receives Field Monitoring alerts about modifications to critical fields and formally approves or escalates them.
Why the mandate to act is as important as the log
Without that separation of roles, Business Central audit becomes theater: the records exist, but there is no one to interpret them or act when an anomaly is detected. Unusual user activities or data modifications that may indicate fraud are easily detected with a complete audit trail. But detecting is not enough — someone has to have the mandate to act.
At KCP Dynamics we structure this governance model as part of the Business Central audit implementation process, not as an afterthought. The compliance roadmap is defined in the design phase, together with the approval workflows and the security role matrix. That way, when the auditor arrives, the client already has three quarters of clean, reviewed and documented logs.
From configuration to value: what traceability contributes beyond compliance
Regulatory compliance is the starting point, not the destination. Once Business Central audit is operational and well governed, the log data begins to deliver real operational value.
Business Central audit data can be used to identify bottlenecks and inefficiencies in business processes; furthermore, complete audit trail systems promote accountability by clearly showing who is responsible for specific actions within the ERP. In practical terms: if the log shows that 70% of modifications to payment terms are always made by the same user outside working hours, that is not just a Business Central audit data point — it is a process signal that deserves review.
Value patterns we have observed in real implementations
- Reduction of monthly close time by eliminating manual reconciliation of undocumented changes thanks to Business Central audit.
- Early detection of parameterization errors before they impact consolidated financial statements.
- Acceleration of external audits: when the auditor can directly access the Business Central audit Change Log with filters by period and table, review cycles are significantly compressed.
- Evidence for due diligence in M&A processes or access to institutional financing, where the traceability provided by Business Central audit is an evaluation criterion.
From control tool to information asset
Complete, real-time traceability with defined governance stops being a compliance cost and becomes an information asset. That is what differentiates companies that use Business Central audit as a control tool from those that use it as a transformation tool.
At KCP Dynamics we accompany that transition from day one of the implementation. If your company needs to demonstrate traceability to regulators, auditors or investors — and do so without slowing down operations — the starting point is a conversation about your current regulatory framework and how to map it to the correct Business Central audit configuration.
Content prepared by the KCP Dynamics consulting team, with more than 10 years implementing Microsoft Dynamics 365 Business Central in manufacturing, financial services and retail companies in LATAM.
Frequently asked questions
Does the Business Central Change Log impact system performance?
Yes, but the impact is manageable if configured with criteria. Activating the Change Log on all tables without filtering generates unnecessary volume and can slow down queries. The recommended practice for an efficient Business Central audit is to activate it only on tables with direct financial or regulatory impact, and to combine that with automatic retention policies that prevent uncontrolled database growth. Microsoft explicitly recommends using “Some Fields” instead of “All Fields” on high-volume tables.
Does Business Central comply with the requirements of Brazil’s LGPD?
Business Central provides the technical tools necessary to support LGPD compliance: Activity Log to record access to personal data, data classification, retention policies and granular security roles that implement the principle of least privilege. Business Central audit oriented to LGPD covers access logging and traceability of personal data processing, in line with what the ANPD requires. However, actual compliance depends on how those tools are configured and governed within each organization. Technology is a necessary condition, not a sufficient one.
How long should audit logs be retained according to IFRS?
IFRS does not establish a specific retention period for electronic evidence, but local tax regulations in countries such as Mexico, Colombia or Peru require keeping accounting documentation for between five and ten years. The common practice in a Business Central audit is to keep active logs in the system for 24 months and export the history to external storage (Azure or Microsoft Purview) to cover the full legal period.
Which Business Central tables should be included in the Change Log to comply with IFRS?
The priority tables in any Business Central audit oriented to IFRS are those with a direct impact on financial statements: chart of accounts, general journals, vendors, customers, exchange rates, payment terms and VAT setup. The rest depends on the sector and the specific regulatory framework. At KCP Dynamics we carry out a regulatory mapping in the design phase to define the exact scope before activating any Business Central audit configuration.
Is it possible to export Business Central audit logs for external auditors?
Yes. Business Central audit includes native log export capabilities that allow extracting data in standard formats for external review. In addition, integration with Microsoft Purview allows centralizing Business Central audit logs together with those from the rest of the Microsoft 365 ecosystem, which facilitates inspections by regulatory authorities or independent auditors.
How does Business Central audit work in multi-company environments?
The Change Log operates independently for each company in Business Central. There is no native consolidated view of logs across entities: each legal entity has its own configuration and its own records. For business groups that need cross-entity visibility, the recommended solution is to export the logs from each company to Microsoft Purview or a centralized SIEM tool. Audit configuration is also not automatically replicated across companies, so it must be managed as part of a documented implementation standard.
Sources
- National Data Protection Authority – ANPD – LGPD
- LGPD development in Brazil: ANPD Resolution No 15/24 | International Bar Association
- New ANPD Resolution on the Statute of Data Protection Officers in Brazil | Privacy World
- Brazil’s General Data Protection Law Explained…
- Setting up Change Log – Dynamics 365 Business Central