Blog Post

It’s Audit Season. Database Audits Shouldn’t Test Your Memory.

Database audits shouldn’t test your memory. See why proving every change is still so hard, and how Change Intelligence makes audit evidence continuous.

October 27, 2026

See Liquibase in Action

Accelerate database changes, reduce failures, and enforce governance across your pipelines.

Example H2

Example H3

An auditor asks a simple question: who authorized this change?

It happened 147 days ago. The approval might be in Service Now change tickets or buried in a log.

It's audit season. And audits shouldn't test your memory.

Database changes happen every day. Whether they're made by DBAs developers, automated pipelines, or AI agents, you need to prove what changed, who authorized it, and which controls were followed. For most teams, that proof still gets assembled by hand, after the fact, under deadline. That's why database audit readiness has become one of the biggest gaps in enterprise compliance, and why it's getting harder as AI speeds up database change.

Database audit readiness starts before the audit

For teams facing compliance regulations,the formal audit is only the last step. Long before fieldwork starts, teams validate that their controls actually worked: testing change approvals, sampling production changes, reviewing who has access, and pulling together the evidence auditors will request.

Nowhere is that prep work more painful than at the database layer. Every sampled change has to trace back to a ticket, an approval, and a policy check. Every control has to show it ran, not just that it exists on paper. For many teams, all of it has to happen before an end-of-year code freeze, while the people who know the change history best are stretched thin by year-end priorities.

Without a reliable record, every control test and evidence request turns into the same project: pull the manual evidence, rebuild the change history, chase the approvals, screenshot the logs, investigate the drift. Then do it again for the next framework your organization reports against.

With Change Intelligence, the record already exists. Validating a control becomes a query, and evidence requests become reports you generate, not histories you reconstruct. Weeks of digging become minutes of proof.

The database audit readiness gap: 2026 research

For the 2026 State of Database Change Governance Report, Liquibase surveyed database, platform, and technology professionals. The results show a clear gap between how often teams are audited and how consistently they can produce evidence.

Audit season never ends. 95% of teams face multiple audits every year. Audit season isn’t a season anymore. It’s the job.

Evidence is a coin toss. Only 32% of teams reliably have audit-ready database change history. Everyone else is crossing their fingers when the auditor asks.

Controls run on memory. Only 35% consistently automate security and compliance checks. When checks depend on someone remembering, deadline pressure wins every time.

Drift is hiding in plain sight. Only 31% consistently automate drift detection. If you’re not watching for unapproved changes in production, your auditor will find them for you.

The pattern is consistent. Most teams have some controls and some evidence, but they aren’t applied consistently, and not automatically. That inconsistency is where audit findings are born.

Read the full 2026 State of Database Change Governance Report →

Why database changes are so hard to audit

Application releases usually leave a clean audit trail. Database changes often don't.

When auditors ask for evidence, database teams are left reconstructing change history from disconnected sources. These include outdated spreadsheets, partial deployment logs, and ticket exports that aren’t linked to the changes they describe. They also include screenshots that can be edited, approvals buried in chat threads, and CI logs that have already expired.

The impact reaches across the organization:

Compliance teams spend weeks gathering manual evidence.
DBAs are pulled off delivery to reconstruct change history after the fact.
Developers lack guardrails, so risky changes reach production and are flagged later.
Regulators and auditors expect tamper-evident, system-generated evidence, not screenshots and spreadsheets.

The result is time-consuming and error-prone.Worse, it pulls your best engineers off delivery right when the business needs them most.

For a closer look at the questions auditors ask and what automated evidence changes, read From Audit Fire Drill to Speed Advantage.

AI raises the stakes for database accountability

AI agents are now participating in software delivery. They write SQL, open pull requests, and in some pipelines, deploy database changes on their own. That increases both the speed and the volume of database change. In the 2026 research, 46.5% of respondents cited ungoverned AI-generated SQL as a top AI-related database change risk.

Auditors haven't changed their questions. They still want to know what changed, who approved it, and whether policy was followed. But the answers are harder to find when the author is ai-agent-042 and the approval field is blank.

The chain of accountability now has three links:

Humans write and approve changes.
AI agents now participate across the SDLC.
Audit readiness requires system-enforced governance and evidence that applies to both.

If your controls depend on a person remembering to check, AI will outrun them. The only governance that scales with AI is governance built into the pipeline itself.

How to build an automatic database change audit trail

Built for audit season, ready all year: the fix isn't a faster scramble. It's making audit evidence a by-product of the pipeline, so it's already there when someone asks.

Liquibase Change Intelligence automatically captures database change activity and metadata across environments, so every change is validated, logged, and reportable. Each change is linked to its actor, its approval, and the pipeline run that deployed it, in one tamper-evident record:

Every change is recorded automatically: who ran it, why, and the exact SQL it executed, ready the moment an auditor asks. Here’s what that looks like across the audit cycle.

Before the audit: fix findings early. Change Intelligence surfaces drift, failed policy checks, and missing approvals in one view while there's still time to act. Out-of-process changes get caught when they happen, not in the audit room.
During the audit: answer on demand. Pull complete, tamper-evident change records for any database in seconds. Generate audit-ready reports for SOX, PCI DSS, and more, with AI-driven analysis that explains each finding and points to the fix.
After the audit: stay ready. Evidence keeps building as you ship, so next year starts finished instead of from scratch. Q4 looks like every other quarter.
Across all of it: one standard for humans and AI agents. Change Intelligence tracks AI agent changes with the same rigor as human ones. Every change, from every author, gets the same policy checks, the same approval record, and the same audit trail.

It works across 65+ supported databases and alongside the CI/CD platforms your teams already use, including Jenkins, ServiceNow, GitLab, GitHub Actions, and Azure DevOps.

See Change Intelligence →

Prepare, prove, and stay ahead

Whether your next audit is in two weeks or two months, these resources can help you find the gaps and close them:

The Audit-Ready Database Playbook: a practical guide to database change governance, evidence collection, and audit preparation.
Navigating 45 Compliance Regulations: what database teams need to know about the regulations auditors actually ask about.
Database DevOps Risk Assessment: identify your biggest gaps and get personalized recommendations.

Audit readiness is an ongoing discipline, not a seasonal exercise. A connected, reliable change history helps teams demonstrate authorization, verify control performance, and respond to evidence requests without reconstructing events across separate systems.

Audit season comes around. With Liquibase Secure, audit readiness never goes away.

The auditor will ask the same question next year. The difference is whether you answer it in minutes from a record you already have, or in weeks from a record you have to rebuild.

Stop scrambling for evidence. Start with Change Intelligence.

See Change Intelligence in action → | Check your database audit readiness with an expert →

Database Audit Readiness FAQ

What do auditors ask about database changes?

Auditors typically want to know what changed, who initiated and executed the change, who authorized it, when and where it was deployed, and whether required controls were followed. They may also examine whether changes occurred outside the approved process and how discrepancies were investigated.

What counts as database audit evidence?

Strong database audit evidence is a complete, tamper-evident record that links each change to its author, approval, ticket, deployment run, and policy check results. Screenshots, spreadsheets, and chat exports can support an audit, but disconnected or manually assembled records may require additional verification.

How do you prove who approved a database change?

Capture approvals as part of the delivery workflow and link them directly to the change being deployed. Each change then carries a record of who approved it and what they authorized. Your team can retrieve that record when needed instead of reconstructing the approval history from tickets, emails, and chat threads.

How do AI agents affect database audits?

AI agents increase the speed and volume of database change, but auditors still expect a clear owner and approval for every change. Teams need system-enforced controls that apply the same policy checks and audit trail to AI-generated changes as to human ones. AI adds another participant to the change process, but it doesn’t remove your team’s responsibility for the outcome. You still need to know what the agent did, which person or team was accountable, and whether required checks and approvals happened. The same governance requirements should apply whether a change starts with a developer or an AI agent, with additional oversight when the risk calls for it.

How can teams stay audit-ready all year?

Automate evidence collection, policy checks, and drift detection as part of every deployment. That means recording who changed what, when, and where for every change, running the same checks on AI-generated SQL as on human-written SQL, and catching out-of-process changes as they happen. When evidence builds as you ship, each audit becomes a report you generate rather than a project you staff.

Ryan McCurdy

VP of Marketing

Ryan brings more than 14 years of experience leading marketing at hyper-growth technology companies. He has built and scaled high-performing marketing organizations across cybersecurity, SaaS, and developer tools, driving revenue growth through a combination of brand storytelling, product marketing, and data-driven demand generation. Prior to joining Liquibase, Ryan held marketing leadership roles at companies including Astronomer, Bolster, Lacework, and Druva. Ryan holds a BA in Film Production from Brooks Institute and an MBA from Walden University.