Evaluating audit evidence in e-signature products

Evaluate audit evidence by obtaining the completed document and its event record. Ask whether someone who did not send the request can match the two files and explain the recorded sequence. A visible signature alone cannot answer every question about the transaction.

Set the questions first

For a harmless sample agreement, ask which file was sent, to which addresses, what actions were recorded and when, whether the request changed, and which copy is final. Decide which answers your organisation needs before judging a provider’s report.

An email or IP address is a recorded signal. Neither proves by itself who controlled a mailbox or device. If the transaction needs stronger identity evidence, specify the authentication method before sending and check what result the record retains.

Key Audit Evidence Requirements for Australian Businesses

Inspect Docusign, Dropbox Sign and Zoho Sign records

For any proposed product, inspect an exported report from the configuration you plan to use. Check which events, timestamps, identity or authentication details, and status changes it records; do not assume these are present without examining the output.

Docusign describes transaction data as metadata about activities, events and actions on its eSignature platform, including recipient details, event timing, key actions and system-level tracking. It says the Certificate of Completion is an electronic record serving as an audit trail, and distinguishes transaction data from eDocument content. Inspect the outputs your organisation needs and decide which files the records owner must save independently.

Dropbox Sign says executed signature requests have an appended audit trail with an identifier linked to its transaction log, and it processes that log with hashing technology so tampering is detectable. Its transaction records include a PDF hash that can help assess whether a questioned copy changed. Where the record exposes the hash, compare it with the questioned PDF and investigate any mismatch.

In Dropbox Sign, documents signed with the Just Me self-signing option have no audit trail. On a Dropbox Sign team plan, you can configure the account so the audit trail is returned to you as a separate file instead of being attached to the signed document.

Zoho Sign adds a certificate-based digital signature: the sender's encrypted hash is appended to the document with the sender's public key certificate, and the recipient decrypts it and checks that both hashes match. In Australia it uses certificates from GlobalSign GCC R6 AATL CA 2020. Every signed document also carries a completion certificate with timestamps, IP addresses and signer actions.

Reconcile the files

Keep the submitted file, finished PDF and exported event record from a harmless request. Compare the identifiers, recipient details, action order and final status.

Repeat with an abandoned or corrected request so the difference is visible. If identity verification is required, confirm which result can be retained without collecting unnecessary identity material.

For a consequential document, check the Electronic Transactions Act 1999, administered by the Attorney-General's Department. Its Division 2 sets the Commonwealth requirements for writing, signature, production of documents and retention, so test each evidence package against the signature and retention sections before relying on it.

How to Reconcile E-Signature Files and Audit Records