Which approach best ensures audit trails capture all auditable events?

• A. Automated log generation with no human review.
• B. Random sampling of events.
• C. Complete interviews and observation of audit logs for each auditable event.
• D. Only critical events are logged.

Answer: (C)

Ensuring audit trails capture all auditable events means proving that every event is actually recorded and that the logs reflect what happened for each one. This approach uses thorough checks that apply to every auditable event, combining hands-on verification with observation of the audit trails. By interviewing the personnel responsible for logging and by observing the logs for each event, you confirm two things: the logging controls exist and are correctly configured, and there are no gaps where events go unrecorded. This provides strong assurance that the audit trail is complete and reliable for forensic analysis and compliance.

Relying solely on automated log generation with no human review can miss configuration errors or gaps; sampling events risks missing important occurrences; logging only the most critical events leaves out others that may be needed for investigations or regulatory requirements.