Finalise forensic audit requirements document

[bushjames]

Request Summary:

DA needs to finalise the requirements in the forensic audit requirements document so we can prioritise development efforts.

Requirements Document: https://docs.google.com/document/d/1ToocVyp9iZWrv_KN-6sizgMzC_gioR8LsVMyeM9huqU/edit?usp=sharing

Request Details:

• Deadline: asap
• Impact (Teams):
  • core team
  • adopters?
  • community members?
• Impact (Components):
  • forensic audit service
  • forensic audit service client(s)

Artifacts:

• Audit Requirements Document [@bushjames]

Dependencies:

• Research on Audit Tools for Mojaloop Deployments #119
• Discuss audit best practices #126

Accountability:

• Owner: @bushjames
• Raised By: @PaulGregoryBaker @vijayg10

Decision(s):

• Audit log must include all incoming and outgoing API requests incl. headers, body.

• Approved By:

Details

Follow-up:

• Actions to implement the decisions

[bushjames]

DA members to review the requirements document and complete the table "Events to be included in Forensic Audit Log" before DA meeting on 10th September 2025.

[bushjames]

Document still missing some important elements i.e. list of events to include in audit. @PaulMakinMojaloop to share list of audited events from vNext review process with @bushjames for inclusion in the document.

@bushjames raises that a deployment project upcoming may have some allocated budget to look at implementation.

[bushjames]

The group notes that the typical implementation process would be for the requirements doc to feed into a workstream and turned into user stories / epics, then taken for design review with DA members before being worked on in sprints.

The DA should expect implementation designs to be brought back for review before implementation commences.

[bushjames]

Discussed on today's DA call:

PB raises that the doc needs much more detail in specifying precisely what needs to be included in the forensic audit log.

Results of discussions and decisions from this ticket: #119 need including in the requirements document asap.

JB will make a first pass and bring back for review.

[bushjames]

JB will prioritise completing the requirements doc asap.