If you have not such tracking in place, then how do you know this person in IT changed his attendance records? If you can actually prove it, the charge is called "tampering with data" and the offender should be fired right the heck now!
--Jeff Moden
Change is inevitable... Change for the better is not.