15/07/2026
The audit trail you can't produce on demand
Since 15 January 2026, under Decree 05/2026, the State Bank of Vietnam can compel a bank to commission an independent audit — at its own cost — when the data it provides in an inspection looks erroneous or unreliable. Which raises a question most institutions haven't had to answer under pressure: when someone asks how a loan was actually operated, can you show them — or do you have to rebuild it first?
1. Most audit trails are reconstructed, not kept.
When the question comes, most institutions assemble the answer after the fact — pulling logs across servicing, collections, and CRM, reconciling timestamps into a trail that didn't exist as one record until someone asked. Reconstruction satisfies the rule right up until it's tested, and it's weakest exactly when it's tested: slow, partial, contestable when scrutiny is highest. Decree 05 makes that reconstruction something a supervisor can require precisely when the evidence starts to look questionable.
→ A reconstructed trail is strongest in calm and weakest under inspection.
2. Evidence can be a system property, not an afterthought.
One alternative is evidence generated as the loan is operated — each stage, from approval through servicing to recovery, writing to one continuous record as it happens rather than being reassembled later. It answers on demand because it was never taken apart. Basel's operational-risk principles already treat data integrity and auditability as a prudential expectation, not a nicety.
→ Evidence built during ex*****on doesn't have to be rebuilt to be shown.
3. Scale is what forces the choice.
At low volume, reconstruction is a nuisance you can absorb. At scale it stops being viable. System credit reached roughly 20 quadrillion VND by mid-2026, up more than 18% year-on-year. Taken together, recent rules — Decree 05/2026, Circular 83/2025, Circular 43/2025 — increase the practical importance of evidencing ex*****on, not just documenting policy.
→ Regulation is the pressure test. Scale is the reason.
A policy is a document you keep.
An audit trail is a claim about what happened — only as strong as the moment it's tested.