Xero keeps an audit trail, but not a complete one. Its History and notes report shows changes to invoices, bills, contacts, inventory items and fixed assets, with the date and the user, and exports to Excel or PDF. Only administrators can run it, it doesn't cover payroll transactions, expense claims or organisation settings, and Xero has said a complete audit trail of every event "is not in our plans". For a small team that's often enough. As more people get access, add simple controls: tidy user roles, approvals on bills and payments, an alert when a supplier's bank details change, and a short monthly check. Where nothing off the shelf fits, a small monitoring tool can watch your Xero data for you.
The problem in plain English
When three people use Xero, everyone knows who did what. Add more staff, an external bookkeeper, a payroll officer and the accountant at year end, and nobody does. A pay rate changes and no one can say who changed it. A bill from last quarter gets re-coded, and the reports you sent the bank no longer match. A supplier's bank account is updated, and the next payment run goes to it unchecked.
Most of this is ordinary mistakes by busy people. One risk is deliberate: payment redirection. Scamwatch, run by the ACCC, describes business email compromise scams, where scammers pose as a supplier and send new payee details so a legitimate payment goes to them. A warning sign it lists is "a vendor or supplier's payment details change without notice", and its advice is to check any change by phone, on a number you found yourself.
So the questions are simple: who changed it, when, was it checked, and would we notice next time?
What Xero gives you today
Checked against Xero's help pages and developer documentation in October 2026. Xero changes features from time to time, so confirm the details for your plan.
History and notes on each record. Invoices, bills, contacts, items and bank transactions each have a History and notes section listing events (created, edited, approved, paid) with the date and user. Changes made by an app through the API show as "System Generated".
The History and notes report. In the Accounting menu, the History and notes report brings those changes together. Xero's help page says it is "sometimes referred to as an 'audit trail' or 'audit log'". You can filter by date, user and type. Points to know:
- Only users with the administrator role can run it.
- It shows up to 1,000 results per run, in pages of 100, so busy organisations need short date ranges.
- It doesn't include payroll transactions or expense claims.
- It excludes organisation settings, reporting, printing and exporting.
The Journal report. This lists the accounting entries behind every transaction. It tells you what was posted, not why or who approved it.
User roles and lock dates. Xero has a fixed set of user roles (such as Adviser, Standard, Invoice only and Read only), with extra permissions for areas like payroll, and no custom roles. Lock dates stop most users changing closed periods. Used properly, these do more for control than any report.
Where the gaps are
Each gap is a long-running request on Xero's own ideas board (votes as at 29 October 2026):
- A full audit trail. The Audit Trail Report idea has 593 votes and is marked "Not in pipeline". In December 2025 Xero replied that "providing a complete audit trail of every single event and change within an organisation is not in our plans", pointing to the Journal report and recent History and notes improvements.
- Supplier bank-detail change alerts. Payroll admins are told when an employee's bank details change. For suppliers, ideas-board users and app vendors report the notice goes only to the person who made the edit. The request to choose which users receive bank account change notifications has 264 votes. Xero marked it "Accepted" in September 2026 but said it "isn't directly on the roadmap just yet".
- Mandatory tracking. Making tracking categories required has 296 votes and has been open since 2012. Xero's July 2025 reply says it "isn't on our roadmap" and suggests the find and recode tool instead. Untagged lines quietly break job and branch reports.
- A missing-attachment report. A file attachment report has 301 votes. In July 2025 Xero said it has no plans to build one; attachments show on list pages, so finding gaps is manual.
- Supplier credit limits. Credit limits on supplier contacts has 214 votes and is "Not in pipeline" (March 2026). Xero suggests a note on the contact instead.
None of this is a reason to leave Xero. It means some checking has to come from your process or a tool alongside Xero.
Your options, simplest first
Many businesses only need the first three.
- Review who has access, and what they can do. List every user, including former staff, the old bookkeeper and unused app connections, and remove what isn't needed. Give each person the lowest role that does the job, keep payroll access to payroll staff, and limit who can edit supplier contacts. Set a lock date after each month-end.
- Put approvals on bills and payments. Agree who approves bills, who can change supplier details and who releases the payment run, so no one person does all three. For approvals by amount, supplier or department, an approval app is the usual answer. ApprovalMax is well established (4.8 from 668 reviews on the Xero App Store when we checked) and records who approved what. Our post on purchase order approvals across systems covers ordering that happens outside Xero.
- Alert more than one person when bank details change. Small apps fill this gap. For example, VendorAlert (on the Xero App Store since July 2026) emails the people you choose when a contact's bank details change, for A$9 per month per organisation including GST at the time of writing. Either way, follow Scamwatch's rule: call the supplier on a number you already have before paying new details.
- Ask your accountant about practice tools. Practices use data-health tools such as Xavier and Dext Precision to find coding problems and duplicates. They're built for accountants, not owners, but if yours uses one, ask for the results monthly.
- Run a short monthly controls check. At month-end, an administrator runs the History and notes report for the month and looks for changes to past periods, supplier contacts and approved bills, then checks untagged transactions and bills without attachments. Note who checked. Our month-end checklist for several systems shows where this fits.
- Build a small monitoring tool when nothing fits. If you want one place that answers "what changed this week, and was it expected?", a small tool can read your Xero data each night and list the exceptions: changed supplier bank details, untagged lines, bills without attachments, edits to closed periods, spend over a supplier's agreed limit. We build this kind of tool, alongside Xero rather than instead of it. It doesn't block a change; it makes sure the right person sees it.
Costs vary widely depending on the size of the business, how many systems are involved and how much needs to be custom-built, so we scope every project first and give you a fixed quote after a free initial chat.
How a monitoring tool works
For whoever looks after your systems: Xero's API has a history endpoint for documents such as invoices, contacts, bank transactions, items and manual journals, returning each change with date, user and description. A nightly job can snapshot contact bank details and compare them with the last run. The Journals endpoint shows postings to earlier periods, and attachments and tracking can be read per transaction. The design choices that matter are who gets which alert, how a change is marked "checked", and staying within Xero's API limits. Payroll is harder: its changes aren't in the History and notes report, so check what the payroll API exposes first.
It's the same idea as a monthly integration health check: automate the checking so a person only looks at exceptions. See our Xero API integration service for how we build these, and the Xero and MYOB integration guide for related reading.
When it's worth getting help
Controls often break down for a reason unrelated to Xero: if your bookkeeper is the only one who understands the approval rules, the bank details process and the month-end checks, that is a risk in itself. See when only one person knows how it works.
If you've tidied roles and added approvals but still can't answer "who changed that?", or your finance processes run across Xero, a job system and spreadsheets, our Process & Systems Audit ($5,000) maps how money moves through your business and where checks are missing, with a written report on what to fix first.
Frequently asked questions
Does Xero have an audit trail?
Partly. The History and notes report shows changes to invoices, bills, contacts, inventory and fixed assets with the date and user. It excludes payroll, expense claims and organisation settings, and only administrators can run it.
How do I see who changed something in Xero?
Open the record and scroll to History and notes at the bottom. To search across the organisation, an administrator runs the History and notes report from the Accounting menu and filters by user and date.
Does Xero tell you when a supplier's bank details change?
Not to the people who need to know. According to Xero's ideas board and app vendors, the notice for supplier contacts goes to the person who made the edit. Xero has accepted the request but not scheduled it.
Can I make tracking categories mandatory in Xero?
No, and Xero has said it isn't on the roadmap. Set default tracking options on contacts, use find and recode to fix untagged lines, or run a regular check that lists them.
If more people are working in your Xero than you can keep track of, book a free initial chat. We'll tell you plainly whether tidying roles and adding an approval app will do, or whether a small monitoring tool is worth it.