I am struggling to prove to an auditor that no code was moved without an approva

Timestamps (Last Modified) on the rules can give you an idea of when they were updated. For process models as well you will be able to see the last updated on the latest version.

Do you use any external system for source control purpose?

Hi Joe,
forum.appian.com/.../Logging.html
Here you will get the details about when an object was deleted and who deleted the same in the logs.

The deletion log is interesting i wish there was an import log the deletion log doesn't quite prove that something was imported and then deleted.

siddharth, we use SVN but the admin could in theory move code from some other source

@joep Even our project makes use of SVN. And yes, there is a possibility for deletion of the traces of the code movement in Appian and further it is hard to trace out by exploring the objects and their associated timestamps or content deletions. I opine that there isn't a solution yet as we have come across this question some times but we haven't find an answer so far.

I think the idea of mentioning the deletion.log is that if there's no entry there showing the deletion of the news feed event then you're proving that whatever is in the news feed is what really happened.

If you have the approval email and the post on the news feed then that proves the code was moved with the approval.

You should be able to match all approvals with IMPORT entries in the news feed. If they claim the news feed entries can be deleted, you can explain that those deletions get logged in deletion.log. That's how you'd know if there wasn't any approval, people trying to hide the import can be caught through the deletion.log since it captures deletions of news feed too.