An audited device generates, for each of a plurality of events, an audit file and the audit device locally store the audit files. Upon the occurrence of a trigger condition, the audit device retrieves a batch of audit files stored locally and generates an audit block for transmitting the batch of audit files to an auditing system. The audit block includes the audit files in the batch of audit files, and a digital signature generated based in part on the audit files in the batch of audit files. The audited device then sends the audit block to the auditing system. Accordingly, the amount of data for transmitting the audit files from the audited device to the auditing system may be reduced. Additionally, the computational power for authenticating the audit files to the auditing system may also be reduced.