Key takeaway
An audit trail is worthless if it's the thing you meant to start keeping after the question came up.
Most projects go their entire lifecycle without anyone asking "who changed this, and when, and why." Then, occasionally, someone does: a client disputes when a deadline was actually agreed, a regulator in a controlled industry wants to see how a risk was assessed and by whom, internal leadership wants to understand why a decision looks different in hindsight than it did at the time. In an ad hoc set of tools, spreadsheets, email threads, chat messages, that question is often unanswerable, not because anything was hidden, but because nothing was ever recorded with who and when attached.
Why this bites hardest in regulated or client-sensitive work
In industries with real compliance obligations, or client relationships with real financial or legal stakes, this is not a hypothetical. "Show us the record" is a real request, and "we believe this is roughly what happened, based on people's memory" is not an acceptable answer to it. A spreadsheet that anyone with edit access can silently change, with no history, is not a governance gap that shows up day to day, it is a governance gap that shows up exactly once, at the worst possible moment.
A paper trail that costs nothing to keep
The fix is not a heavier compliance process bolted onto the project. It is a project record that keeps its own history automatically, every status change, every reassignment, every risk update logged with who and when, as a byproduct of normal use rather than a separate task someone has to remember to do. Nobody has to be more disciplined about record-keeping for this to work, the record just has to be built so that using the tool normally is the record-keeping.