What does a regulator mean by a defensible audit trail?

Detailed Explanation

It means the file answers the question "why did you do that?" without anyone having to reconstruct it from memory. Concretely: what the risk assessment concluded and when, what monitoring was applied as a result, which alerts were raised, who reviewed each one, what evidence they looked at, what they decided, and who approved it. Dated, attributable, and stored somewhere it survives staff turnover. The test is not whether every decision was correct. It is whether a reviewer arriving two years later can see that a documented process was followed and that its conclusions were reasonable on the evidence available at the time.