I'm developing an enterprise application for internal users of a business. Our application has multiple "filings" with unique filing IDs. As part of this application, we're building a detailed audit system that will track events that can happen in a filing (such as uploading documents, changing information, reassigning, etc) and their event timestamps.
One of the features that the application will provide is storage and categorization of emails; instead of people emailing the users of the system, people can email the system itself so that all communication is logged and audited. Communication received by the system will become part of the larger audit history.
There are generally two timestamps associated with an email message; the time and date it was sent, and the time and date it was received. Email is practically instantaneous in the general sense, but there are cases where emails can be delayed for multiple reasons.
When building a user interface that allows a user to view audit history, including emails received by the system, which date should be used as the canonical event date? Should it be the sent time, or the received time? Why?