A maintenance manager opens last quarter's brake job invoice and finds the original work order shows $1,200, the closed total shows $4,800, and nobody can explain when, why, or by whom the labor hours doubled. This is the conversation that makes CFOs request audit software. Without granular edit history, work orders are write-once-then-mystery perfectly fine until they're not. With a complete edit log, every change records the field that changed, the old value, the new value, who made the edit, when, from what device, and (optionally) why. Six fields became eighty. Then twelve hours of labor became twenty-eight. Then a new technician was assigned. Each change immutable, each one queryable, each one defensible in audit. Fleet Rabbit logs every work order modification with 8 data points per change — and gives you the search/filter interface to find suspicious patterns in seconds. This guide shows what's tracked, how the diff display works, and the common edit patterns that fraud, scope creep, and good-faith documentation gaps actually look like in real fleets.
Every Change. Every User. Every Time. Append-Only.
Field-level edit history with old value, new value, user, timestamp, device, and reason for every modification. Search across thousands of work orders. Defend any audit. Catch the scope creep, the time-card padding, and the ghost edits before they become next quarter's mystery.
Why Edit History Matters — The Audit Questions Nobody Wants Asked
Edit history isn't a vanity feature. It's the answer to specific questions FMCSA auditors, insurance investigators, internal finance, and litigators routinely ask — and the absence of which has cost fleets millions.
The Anatomy of One Edit — What Gets Captured Every Time
Below is what a single field change looks like in the Fleet Rabbit edit log. Every field has its own change record. Every change has the same 8-point structure. The example: a technician updates labor hours from 2.5 to 3.8 on Tuesday morning.
The 8 Fields Logged Per Change
Every modification — whether it's a technician fixing a typo, a supervisor escalating a cost, or the system auto-updating from a sensor reading — generates the same 8-point record. Consistency is what makes the trail searchable across years of work orders.
Which field changed (status, cost, labor, parts, tech, priority, notes, photos, etc.). Schema-aware to prevent ambiguity.
Captured at the moment before edit. Frozen — never overwritten. The "before" state of the field.
The value the user submitted. Also captures whether change was accepted, queued for approval, or rejected.
Authenticated user ID + name + role + email. Tied to active SSO session — no shared accounts, no anonymous edits.
Date, time, timezone — set server-side to prevent client-clock tampering. Sub-second precision for ordering.
Mobile vs desktop, app version, device ID, OS version, IP address. Forensic detail for compliance investigations.
Where the edit was made (when device permits). Catches "edits made from home at 11pm" patterns that warrant review.
Optional free-text justification. Required on certain field types (cost >10% variance, status reversals, time edits).
The Edit Patterns That Should Make You Look Closer
Not every edit is suspicious. Most are routine — typos, status updates, completion timestamps. But certain patterns show up in fraud cases, scope creep, and time-card padding. Knowing the shape of risky edits is half the audit defense.
Labor hours edited at 11pm-3am from non-depot IP addresses. Common signal of after-the-fact time padding. Routine in fraud-loss investigations.
Total cost goes up but parts list, labor hours, and outsource fees don't change. The math doesn't add. Either bad data entry or someone hiding a number.
A closed work order reopens. Sometimes legitimate (warranty rework, missed defect). Sometimes used to add costs after the fact while keeping the original close-out untouched.
One user makes 8+ field changes in 2 hours on the same WO. Could be normal workflow. Could be reconciling a problem they want to bury before close-out.
Cost variance >10% requires a reason note. Edits that bypass this — typically via API or admin override — are flagged for audit review.
Edits originating from residential ISPs, VPN exit nodes, or international IP addresses. Most legit edits come from depot WiFi or carrier mobile data.
The Search & Query Interface — Find Any Edit in Seconds
Edit history is only useful if you can find what you're looking for. Fleet Rabbit's query interface lets safety, finance, and compliance teams cut across thousands of work orders by user, date range, field, value-change-magnitude, IP source, and pattern type.
The flagged result above is the kind of pattern an auditor finds in seconds with the platform — and never finds without one. See the Live Edit Search Interface →
How Fleet Rabbit Compares to Spreadsheet / Email-Based Tracking
| Capability | Spreadsheet / Email | Fleet Rabbit Edit Log |
|---|---|---|
| Field-level change tracking | None or manual notes | Every field, every change |
| Old + new value capture | Lost on overwrite | Both preserved permanently |
| User identity per change | "Last edited by Dave" maybe | SSO-authenticated, immutable |
| Timestamp precision | File save time only | Server-side, sub-second |
| IP / device / GPS | Not captured | All three, every edit |
| Search across all WOs | Manual file-by-file | Indexed query, <2 sec |
| Pattern detection | Impossible at scale | Built-in anomaly flagging |
| Append-only enforcement | None — files editable | Cryptographically signed |
| FMCSA audit export | Days of preparation | PDF in <30 seconds |
Frequently Asked Questions
Can edits be deleted or modified after the fact?
No — append-only by design. Edits cannot be removed, overwritten, or modified. Subsequent edits can correct previous edits (e.g. "labor hours was wrong, here is the correction") but the original record remains visible in the trail. Append-only is what makes the log audit-defensible. Removing it would defeat the entire purpose.
How long is edit history retained?
Indefinitely on Fleet Rabbit's standard plan, with a hard minimum of 7 years to comply with FMCSA / DOT retention rules (49 CFR 396.3 maintenance records, 49 CFR 391.51 driver qualification records). Some asset categories (HM endorsement, hazmat) require longer retention; the platform tracks the regulatory minimum per asset class. See Retention Configuration →
What about edits made by integrations or APIs?
API-driven edits log with the API key holder identity, source IP, and a flag distinguishing them from human-driven edits. This matters because audit reviewers want to know whether a value changed because a person typed it or because a sensor / ERP / fuel-card system pushed it in.
Does Fleet Rabbit auto-flag suspicious edit patterns?
Yes — six default patterns are flagged automatically (late-night edits, missing reasons on variance, status reversals, etc., as detailed above). Custom rules can be added per fleet — e.g. "flag any cost edit >$5,000 that doesn't include a parts list change." Flagged edits route to a review queue for the safety/finance manager.
Can drivers see their own edit history?
Yes — driver portal shows their own DVIR submissions and any edits made to their work orders. Drivers cannot edit history; they can only add new entries. This transparency reduces "who changed my hours" disputes and helps drivers spot legitimate errors before they compound. See Driver Portal Demo →
How is edit history priced?
Included in the $3/vehicle/month standard subscription. No per-edit fee, no separate audit-log module pricing, no storage caps for the 7-year regulatory minimum. Free tier (up to 3 assets) includes full edit history for testing. Book a Demo to See Pricing →
8-field edit log per change. Old value + new value preserved. SSO-authenticated user identity. Server-side timestamps. Device, IP, GPS. Optional reason notes. Append-only with cryptographic signing. Indexed search across years of work orders. Auto-flagging on six suspicious patterns. PDF audit export in 30 seconds. Free for up to 3 assets indefinitely.
