Audit Pack and Integrity (Hash Chain and Period Sign-Off)
Turn on the inalterable hash chain, scan the period for integrity, and lock it under a segregated manager sign-off so a reviewer can rely on the ledger.
Why this module
Audit Pack and Integrity (Hash Chain and Period Sign-Off)
The hash chain, actually re-verified
Sign-off does not just check that a move carries some hash; it re-derives the inalterable chain through core's per-prefix integrity check and blocks if any link fails to recompute. A move whose stored hash or a hashed field was edited underneath a stale hash is caught, not waved through.
The preparer cannot sign their own work
The user who runs the checks is stamped as preparer of record on the first run and is never overwritten. Sign-off is refused if that same user attempts it, and both the preparer and signer identities are anchored so a direct RPC write cannot reassign or clear them.
The gate is recomputed at sign-off
Checks are rescanned against the live ledger at the moment of sign-off, so a period that has since gained a draft, unbalanced, or unhashed entry cannot be signed off on a stale stored result. An unmet blocking check, a self-sign-off, or an already-signed period each raise an explicit message.
Day in the life
Closing March under review
You open a new audit pack for the March period, click Enable Hash Chain to switch restrict mode on every posting journal, then Run Checks. Two draft entries and an open bank suspense line surface as blocking and warning rows. A colleague posts the drafts and reconciles the suspense, re-runs the checks, and all four controls pass. Because segregation of duties applies, a second EH Accounting Manager reviews the pack and clicks Sign Off. The period is stamped, the chatter records who signed, and the fiscal-year lock date advances to the period end so nothing in or before March can be edited again.
Edge cases
The cases most modules quietly ignore.
In the shipped code today, each one a place where a cheaper module silently does the wrong thing.
Check rows are the sign-off gate, so they are system-written only: direct create, write, or delete is refused even for a manager, and the rows are rescanned live at sign-off so an edited stored row cannot vouch a failing period.
The hashed check does not stop at hash presence; it re-derives the chain through core and treats a recompute that errors as a blocking failure, so a tampered hash or hashed field cannot pass.
The prepared-at and signed-at timestamps cannot be written on their own, and the identity anchors accept only the acting user, so a sign-off time cannot be backdated or reassigned by RPC.
Optional period-close and year-end gates are stored as plain record ids resolved through a registry-guarded browse, so the pack installs and signs off on its own when those workflow modules are absent.
The integrity check delegates to core, which partitions the chain per sequence prefix, so a hashed journal spanning fiscal years is verified correctly instead of being mis-flagged as broken.
What is inside
Built to do the job, end to end.
- eh.audit.pack model. The period record in models/audit_pack.py: draft, checks run, and signed-off states, company and period-from/to, preparer and signer stamps, and a unique-per-company-per-period-end constraint.
- eh.audit.check rows. Append-only integrity result rows produced only by Run Checks; create, write and unlink are all guarded so nothing but the internal refresh can touch them.
- Four integrity controls. No draft entries, posted entries balanced, posted entries hashed (with live chain re-verification), and open bank/cash suspense scanned against each journal's suspense account.
- Hash-chain actions. Enable Hash Chain writes restrict_mode_hash_table on sale, purchase, general, bank and cash journals; sign-off blocks unless the chain is active on every posting journal.
- Roles and isolation. Security in ir.model.access.csv and eh_isolation_rules.xml: EH users prepare, EH managers sign off, EH auditors get read-only, all scoped by company record rules.
- Optional close chain. Linked period-close-run and year-end-run ids add blocking checks and a sign-off assertion only when set, gating on the close being approved and the year-end entry posted.
Honest about the edges
What this does not do, so nothing surprises you.
- It does not generate a PDF or exportable audit report; the pack and its check rows live in the Odoo UI with chatter history.
- It does not detect fraud or judge whether individual transactions are correct; it verifies structural integrity (drafts, balancing, hashing, suspense) and enforces sign-off.
- It relies on Odoo's core inalterable hash chain; on a version that does not expose it, sign-off that advances the lock date is blocked rather than emulated.
- The period-close and year-end gates are optional links to separate ERP Heritage modules; without them, those legs stay inactive and are not enforced.
- It advances the fiscal-year lock date at the company level on sign-off; it does not manage tax or other lock dates.
odoo 19 audit trail, inalterable hash chain odoo, period integrity scan, secure posting hash chain, fiscal year lock date, segregation of duties sign off, audit pack period close, tamper evident ledger odoo, posted entries hashed check, bank suspense check, accounting audit controls odoo community, immutable journal entries, period sign off odoo, restrict mode hash table
Period integrity checks and sign-offThe audit pack runs draft-entry, balance, and hash-chain integrity checks and gates the manager sign-off until every blocking check passes.
Modules teams pair with this one.
Premium ERP Heritage modules that extend the same stack, each built to the same engineering bar.
Connect Odoo partner records to the Saudi SPL National Address service and the Wathq commercial registry
One click install of the full Employment Hero integration for Odoo Community, covering the connector, two way syn...
The Malaysia country pack for the ERP Heritage Employment Hero integration
A dependency free asynchronous job queue that runs long running and fan out work out of band of the request that...
Post Irish payslips to the general ledger on the Irish chart of accounts
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
Discuss (mail)
• Invoicing (account) |
| Community Apps Dependencies | Show |
| Lines of code | 4606 |
| Technical Name |
eh_account_audit_pack |
| License | LGPL-3 |
| Website | https://www.erpheritage.com.au/ |
Please log in to comment on this module