Sanctions screening audit trail: find and verify the evidence

Start with the decision someone needs to check

A sanctions audit trail should help another person explain what was checked and why a decision was made. In SanctionsKit, find the result in Screening history and its case in Review queue. Review audit trail holds retained human decision history. Operations reports gives activity totals.

These records have different jobs. The screening shows submitted facts, coverage and the automated outcome. The case adds evidence, human decisions, outside checks and approval. An activity total cannot replace the evidence for a particular customer decision.

Retrieve the evidence used by the original check

With results:read, call GET /api/v1/results/{id} for a result inside data. GET /api/v1/results/{id}/evidence downloads the raw JSON evidence document, without a data wrapper. Its format is sanctionskit-evidence@1. Read the retained inputs, source versions and retention details.

Check the HTTP status before saving a download as evidence. Minimal retention omits subject, reference and request, so it cannot support full input replay. If a record expired or is missing, state the gap. Today's customer profile is not a substitute for the request sent at the time.

Read the human decision and approval state

Find linked cases with GET /api/v1/cases?screeningId=ID, then read GET /api/v1/investigations/{caseId}. Inspect the current screening, candidate decisions, outside checks, comments and history. Check whether the case was reopened or replaced after the decision you were asked to explain.

GET /api/v1/audit returns pages of retained human decision history. Follow nextCursor until null for the requested collection. Notes may be redacted after retention expiry even while minimal audit facts remain. A history row alone cannot tell you the current investigation state.

Choose the export for the question being asked

GET /api/v1/reports/cases/{caseId}?format=json returns a raw audit packet without a data wrapper. format=pdf returns PDF bytes. For large cases, the archive endpoint returns retained segments under data. Keep the case revision and segment order, and continue until complete is true.

If an archive download reports a revision conflict, discard the unfinished local copy and restart. Mixing segments from different revisions can produce a record that never existed. Use the evidence guide for the full contract, then save copies in your approved storage service.

Check that linked originals can still be opened

A valid-looking link can point to a moved document or the wrong version. Have an authorized reviewer retrieve the intended original. Check its storage service's access and retention rules as well as the case export.

SanctionsKit's external document references do not store the original files. Read the audit package alongside the linked evidence. Do not assume that downloading a report also downloaded every document on which the decision relied.

Ask a colleague to explain the case from its records

Give a permitted colleague the case reference. Ask them to identify the submitted subject, lists, original outcome, deciding facts, human decision and approval. Later evidence and corrections should have their own context. They should not appear as facts known before they arrived.

Record anything missing or inaccessible and assign follow-up. Align retention with your approved recordkeeping requirements. A successful download proves retrieval of that artifact. It does not prove that every original is present or that the export is a signed attestation.

Check controls rather than relying on labels

An audit trail, tamper-evident record and immutable record are different claims. A timeline alone does not prove cryptographic tamper resistance, write-once storage or legal admissibility. Evaluate the actual storage and product controls before describing them that way.

Limit access, separate duties when required, review export permissions and test how corrections appear. These are concrete checks. Record their results and limits so the next reviewer can assess the evidence without relying on an unexplained marketing term.

Frequently asked questions