Skip to content

Compliance and Audit Reporting

⚠️ Partially in scope for MVP — Write path required, UI deferred (as of 2026-04-16)

The v3.0 PDF requirements document explicitly covers this user story but splits it across two phases:

  • MVP (back-end queryable only) — PDF p.11 RFP ref 9: "Initial versions of the MVP will allow user activity to be queried by Platform Admins via the back-end support team only." Also p.15 RFP ref 3: "User activity such as Credential Offers, Issuance, Presentation requests and Verification will be logged by the system as an audit trail."
  • Drop 1 Beta / later — Full admin UI + compliance/audit reporting per PDF p.4: "Generate compliance and audit reports (user access, data changes, consent logs) on demand and scheduled basis."
  • Production hardening — PDF p.4 Non-Functional: "Maintain detailed and immutable audit logs, including timestamped records for all data access and changes."

Current POC state: - audit_logs table is defined via AuditLog entity (columns: action, resourceType, resourceId, before, after, actorUserId, orgId, ipAddress, userAgent, createdAt). - No service writes to it yet — zero call sites. The POC is technically non-conformant with the PDF's MVP audit clause until Phase A of the reconciliation plan ships.

What's missing: - AuditLogService + NestJS @AuditLog() decorator/interceptor to auto-capture API-level events (Phase A, MVP-required) - Reporting/export API and UI for compliance officers (Phase B, Drop 1 Beta) - Integration with Auth0 log streams for authentication events (Phase C, Drop 2) - Immutability guarantees: append-only storage, cryptographic hash chains (Phase D, Production Hardening)

Roadmap: see Task 24 — Logging & Tracking Reconciliation for phase-by-phase plan with PDF references cited inline.

Overview

This user story covers the functionality for generating reports for compliance and audit purposes, including user access, data changes, and consent tracking, enabling staffing company administrators to demonstrate regulatory compliance and maintain proper audit trails.

User Stories

US-RA-04: Generate Compliance and Audit Reports

As a staffing company administrator,
I want to generate compliance and audit reports,
So that I can demonstrate regulatory compliance, maintain proper audit trails, and provide necessary documentation for internal and external audits.

Acceptance Criteria

Scenario 1: Generating User Access Reports 

Given I am logged in as a staffing company administrator
When I navigate to the compliance reporting section
And I select "User Access Report"
Then I should be able to generate a report showing who accessed what data and when
And I should be able to filter the report by user, data type, and time period
And the report should include all required access details for compliance purposes

Scenario 2: Tracking Data Changes 

Given I am in the compliance reporting section
When I select "Data Change Log Report"
Then I should be able to generate a report showing modifications to sensitive information
And the report should include who made each change, when, and what was changed
And the report should show both the previous and new values for changed data

Scenario 3: Monitoring Consent Activities 

Given I am in the compliance reporting section
When I select "Consent Tracking Report"
Then I should be able to generate a report showing user consent actions
And the report should include consent timestamps, consent types, and consent status
And I should be able to verify the complete consent history for any user

Scenario 4: Tracking Credential Activities 

Given I am in the compliance reporting section
When I select "Credential Activity Report"
Then I should be able to generate a report on credential issuance, disclosure, and verification
And the report should include all relevant metadata for each credential action
And I should be able to filter by credential type, action type, and time period

Scenario 5: Configuring Report Parameters 

Given I am generating a compliance report
When I configure the report parameters
Then I should be able to specify the date range, data scope, and output format
And I should be able to include or exclude specific data elements
And I should be able to save report configurations as templates for future use

Scenario 6: Exporting Reports in Multiple Formats 

Given I have generated a compliance report
When I select the export option
Then I should be able to export the report in multiple formats (PDF, CSV)
And the exported report should maintain all data integrity and formatting
And the exported report should include appropriate headers, footers, and metadata

Scenario 7: Ensuring Regulatory Compliance 

Given I am generating compliance reports
When I select a specific regulatory framework (e.g., GDPR, CCPA)
Then the system should generate reports that meet the specific requirements of that framework
And the reports should include all mandatory elements required by the regulation
And the system should validate that the report meets compliance requirements

Dependencies

  • Audit Logging System
  • User Management System
  • Data Storage System
  • Credential Management System

Notes

  • Compliance reports must be accurate, complete, and tamper-proof
  • The system should maintain an immutable record of all generated reports
  • Report generation should be optimized to handle large volumes of audit data
  • Reports should be designed to meet the requirements of common regulatory frameworks
  • Access to compliance reporting functionality should be strictly controlled