On this page
Most accounting software trusts the people using it. If someone with the right credentials wants to edit a historical transaction — change an amount, delete a journal entry, alter a cost figure — the software lets them. There is no trace, no alarm, and no way to reconstruct what was changed. For small businesses, this may be an acceptable tradeoff. For businesses with multiple employees, external auditors, or any regulatory exposure, it is a silent risk that most CFOs would not accept if they understood it fully.
The Problem with Traditional Accounting Software
Traditional accounting software treats historical records as editable data. While most platforms log user actions — the accounting equivalent of a server log — those logs are themselves editable by administrators. An employee with sufficient access can modify a historical transaction and, with a second action, remove or alter the log entry that recorded the modification.
This is not a theoretical vulnerability. Internal fraud, accounting manipulation and revenue recognition fraud are persistent realities in businesses of every size, and the people best placed to commit them are the ones with the most access.
How Cryptographic Tamper-Evidence Works
A tamper-evident ledger applies the same integrity principle used in blockchain systems to each accounting entry. When a journal entry is written, it is hashed using a cryptographic function (such as SHA-256), and that hash is included in the header of the next journal entry. The chain of hashes creates a dependency: to change any historical record, an attacker would need to recompute every subsequent hash — a computationally detectable signature.
In practice, this looks like this: Ledger Entry #10,001 is hashed. That hash is embedded in Ledger Entry #10,002. Entry #10,002 is hashed, and its hash goes into #10,003. And so on. If someone modifies Entry #10,001 — even by one cent — the hash it would generate no longer matches what is embedded in #10,002. The chain is broken, and any reconciliation audit will surface the discrepancy immediately.
It is the same idea blockchains use, applied to an ordinary double-entry ledger, with no cryptocurrency involved.
RBAC: The Access Control Layer
Tamper-evident ledger chains address the 'can they edit it without being caught' problem. Role-based access control (RBAC) addresses the 'can they access it at all' problem. The two are complementary.
Well-designed RBAC for an accounting system defines multiple roles with dramatically different permission sets. An Owner or CFO has full access. An Accountant can view and create financial entries but cannot override operational settings. A Store Manager can see their location's operational data but not the consolidated P&L or chart of accounts. A Cashier sees only the POS — no inventory adjustments, no financial data.
The combination of RBAC and tamper-evident chaining creates a system where access is controlled at the front end, and manipulation at the data level is detectable at the back end — providing defence in depth.
- Owner / CFO: Full read and write access across all financial and operational data
- Accountant: Full financial access, no operational overrides
- Store Manager: Location-level operational visibility, no financial data
- Cashier: POS access only — no inventory adjustments, no accounting
Audit Trail vs. Tamper-Evident Chain: The Critical Difference
Audit trails and tamper-evident chains are not the same thing, although they are often confused. An audit trail records who did what and when. A tamper-evident chain makes retroactive modification of financial records cryptographically detectable.
You need both. Audit trails tell you the story of how data changed. Tamper-evident chains ensure that story cannot be silently rewritten. An audit trail without tamper-evidence is a narrative that can be altered. A tamper-evident chain without an audit trail tells you something changed, but not by whom. Together, they provide complete financial integrity.
The Regulatory and Due Diligence Case
For businesses undergoing financial due diligence — whether for investment, acquisition, or lender evaluation — the integrity of historical financial records is paramount. Acquirers and investors want assurance that the numbers they are looking at are what they say they are. A tamper-evident ledger provides that assurance in a technically verifiable way, not just a 'trust us' assertion.
Similarly, regulated industries and businesses with external auditors benefit from tamper-evident records because they reduce the cost and scope of audit work. Auditors can verify record integrity programmatically rather than sampling and reconciling manually.
Tamper-evident accounting is not a luxury feature for large enterprises — it is a structural safeguard that any business with multiple employees, external stakeholders, or compliance obligations should consider a baseline requirement. The cost of an accounting manipulation incident — financial, reputational, and legal — invariably far exceeds the cost of choosing software that makes covering tracks detectable.
An Accounting Ledger You Can Unquestionably Trust
Momentum hash-chains its ledger and audit trail with SHA-256, so a changed historical record breaks the chain and shows up. Add roles and per-action permissions, and you can see who did what and show that nobody rewrote it. Book a demo to see the audit trail.
