Who is accountable when a regulated firm cannot produce a transaction record?

Accountability sits with the business owner of the control, not with the audit team that later tries to recover the evidence. Regulators will view missing records as an operational governance failure. The right response is to assign ownership for evidence generation, retention and retrieval at the workflow level, not as a downstream reporting task.

Who is accountable for a missing transaction record?

Accountability belongs to the business owner of the control, because the obligation to create, retain, and retrieve the record sits with the process that generates it. In regulated environments, missing evidence is usually treated as a governance failure, not an audit problem, so the ownership model has to be explicit before the record is ever needed.

Why regulators treat this as a control ownership issue

A transaction record is part of the operating evidence of the firm, so its absence points to a weakness in process design, retention, or retrieval rather than a one-off reporting gap. The practical question is whether the workflow itself was built to preserve a defensible audit trail, including who owns it, where it is stored, and how it can be recovered on demand.

That distinction matters because audit teams can only test or collect evidence that already exists. If the control owner did not design record production and retention into the workflow, the firm has already lost the ability to prove what happened, which is why regulators usually push accountability back to the line owner, operations owner, or system owner that runs the process.

What good accountability looks like in practice

Good accountability is defined at the workflow level, with named ownership for record generation, retention, retrieval, and exception handling. That ownership should be tied to the system or business process, not to a downstream team that only responds after a gap is discovered. If the control is automated, the owner still remains accountable for whether the automation reliably produces usable evidence.

For regulated firms, the useful test is simple: could the responsible team produce the transaction record quickly, consistently, and in a form that satisfies examination or audit? If the answer depends on manual reconstruction, mailbox archaeology, or informal knowledge, then accountability has not really been assigned to the control that matters.

Risk and Threat Considerations

Missing transaction records create both governance and evidentiary risk. The immediate issue is not just noncompliance, but the inability to demonstrate that a transaction was valid, approved, or executed under the right control conditions. That can escalate into supervisory findings, remediation work, and, in serious cases, questions about the integrity of the wider control environment.

Failure mechanism: The control owner treats record preservation as someone else’s job, so the system or workflow never reliably generates or retains evidence, and the firm can only discover the gap after the record is already needed.

Impact: The firm may be unable to substantiate a transaction, respond to a regulator, or prove that its operational controls worked as intended, which can turn a single missing record into an audit and governance issue.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AU-2 — Audit Events	Transaction records are audit evidence that must be generated by the operating control.
	AU-9 — Protection of Audit Information	Missing transaction records reflect failures to protect and preserve audit evidence.
	AU-11 — Audit Record Retention	The question turns on retaining records long enough to satisfy regulatory and audit needs.
Recommendation — Define and generate required audit events at the workflow owner level. Protect audit information so records remain available for review and examination. Retain audit records for the full period needed to support oversight and inquiry.
ISO/IEC 27001:2022	A.5.33 — Protection of Records	Missing transaction records are a records-protection and retention failure.
	A.5.28 — Collection of Evidence	The firm must preserve evidence so it can be produced when required.
Recommendation — Assign record protection and retention responsibilities to the control owner. Maintain evidence collection and preservation procedures for regulated workflows.

Practitioner Guidance

What to verify: Confirm that every regulated workflow has a named owner for evidence generation and retention, and that the owner can show where records live, how long they are kept, and how retrieval is tested. If the answer depends on a separate team “finding” evidence later, the ownership model is already weak.

Decision rule: If a record is required to defend the transaction, then the business or system owner must own its production and preservation from the start. Treat audit, compliance, and records retrieval as validation functions, not as the primary control that makes the evidence exist.

Practitioner takeaway: The accountable party is the one who runs the control, because evidence retention is part of control design, not a cleanup task after the fact.