What you will learn Not a chapter to read but one to do. Using only last week's log, answer four questions. Whatever you cannot answer is your current blind spot.
You can do this alone. But find the answers in the log only. Answer from memory and the exercise teaches you nothing.
These are the questions the audit log has to answer. Write them before you open it.
Why write them first: open the log first and you will shape your questions around what is in it, which hides the blind spots entirely.
| Question | Answer found in the log | Minutes taken | Confident? |
|---|---|---|---|
| 1 setting changes | □ | ||
| 2 member invites | □ | ||
| 3 actions going outside | □ | ||
| 4 most-used tool | □ |
All four inside five minutes — this is working. Go to step 3.
One or two not found — the common case. Separate whether it was not recorded or you did not know where to look. Those are entirely different problems.
More than half not found — it means you could not answer during an incident. That is what step 3 is for.
For each question you could not answer, write the cause.
| Question missed | Not recorded, or did not know where? | How to close it |
|---|---|---|
The second is most of them. And it takes thirty minutes to fix — four lines saying "for this question, look at this screen, like this."
The audit log records what happened, not why. So the last line of this exercise is this.
If that is blank, it is the document you make next.
1. Why write the questions before opening the log?
Because looking first makes you shape questions around what is there. The records that are missing — the blind spots — then never become visible.
2. Why separate "not recorded" from "did not know where to look"?
The remedies are completely different. The first needs a decision about what else to keep; the second needs one line of guidance. The second is far more common and far cheaper.
3. What can an audit log not answer?
Why it was done. The log records what happened, not the reasoning behind it, so the rationale for a settings change has to be written down somewhere else.
Next, signing in with your company account → SSO and department sync
HyperTeams□ 30 minutes□ Admin rights (only admins see the audit log)□ A workspace with at least a few days of activity□ A sheet of paper□ Did anyone change a tool setting last week? Who, and what?□ Did any new members join? Who invited them?□ How many actions went outside (sends, posts)?□ Which tool was used most last week?Rules: □ Do not top it up from memory □ If you cannot find it in five minutes, write "not found"Not recorded -> decide what else to keep; if you cannot, write that fact downDid not know how -> leave a one-line note so the next person finds it in five minutes□ Where do you record the judgement calls that never reach the log (why that tool was enabled)?□ You wrote the four questions before opening the log□ You did not top up from memory□ You classified each miss as "not recorded" or "did not know where"□ You left at least one line of guidance for the next person