A reconciliation audit trail records who matched, under which rule version, who approved the break, and which source file was used. A spreadsheet edited in place does not have that. Auditors are not angry that you used Excel as a worksheet. They are angry if Excel is the only book of decisions.
What must be captured
A user identity, not a shared “finance” login. A timestamp. A source identity: a hash or filename plus download date. Matching-rule version. One-to-many match groups. The reason an exception closed. Without those, the ICoFR story is a poster.
OJK Regulation 34/2025 on rural-bank IT takes effect on 18 December 2026: core application and data backups. A trail that lives only on a staff laptop cannot be restored after the laptop vanishes. Move decisions into a backed-up system even if the parser is still rough.
Why save-as is not enough
final_v3.xlsx does not say who deleted a row. An email copy does not say which matching rule won. A screenshot cannot be rerun. Keep raw, keep output, keep the log. Those three objects are shorter than a folder named “reconciliation 2026.”
OJK’s IASC, as reported by Kompas on 8 September 2026, blocked Rp 771.2 billion tied to fraud. If a movement is held, the trail must show a “blocked” exception, not a row that vanished in the next file version.
Humans remain, with names
Automation does not erase the human trail. It moves humans onto exceptions. Every approval above a threshold needs a second name. A team of five can still do that. What they cannot do is let one person import, match, and journal.
PBI 10/2025 took effect on 31 March 2026. If you are a PSP or a partner, settlement trails will be asked for in the business plan. Prepare a log export now, not when the form opens.
QRIS volume in the first half of 2026, 12.55 billion transactions per Kompas on 18 September 2026, makes a manual trail impossible. A machine log is the only scheme that fits. Holiday calendars that delay settlement must be recorded in the rules so the trail does not look like a bug.
What may stay in Excel
Analysis worksheets, charts for a meeting, a question list for the bank. Not the matching decision list. If Excel is still used, export into the system at day-end and lock the source file.
Frequently asked questions
What is a reconciliation audit trail?
A record of who, when, which rule, which source, and who approved the remainder.
Does Excel always fail an audit?
As the book of record, almost always. As a worksheet exported from a logged system, sometimes it passes.
What is the minimum evidence?
Raw file, match output, rule log, and named exception approvals.
Do matching bots need a trail?
More so. Without a log, “a machine we trust” is an opinion.
What about shared logins?
Turn them off. That finding is predictable before the auditor sits down.
When should we leave spreadsheets?
Before the period under audit is locked. Do not wait for the data request letter.
Test Threadion on one month of your own bank data
Threadion
