An append-only record of who did what and when — logins, permission changes, edits to financial or personal data — kept separately from application logs.
It is required in regulated work and decisive in disputes. Without it, "the balance changed and nobody knows how" is an answer you may have to give a client or a regulator.
We log actor, action, target, and timestamp for sensitive operations, keep the log immutable and separately retained, and make it searchable by support rather than only by engineers.