diff --git a/backend/controller/user.go b/backend/controller/user.go
index 9d9b18f..d224c18 100644
--- a/backend/controller/user.go
+++ b/backend/controller/user.go
@@ -583,7 +583,8 @@ func (c *User) Login(g *gin.Context) {
 				return
 			}
 			// as the recovery code is valid, we can now disable MFA
-			err = c.UserService.DisableTOTP(g, &userID)
+			// no session exists yet during login so pass nil
+			err = c.UserService.DisableTOTP(g, nil, &userID)
 			if ok := c.handleErrors(g, err); !ok {
 				return
 			}
@@ -830,7 +831,7 @@ func (c *User) IsTOTPEnabled(g *gin.Context) {
 
 // DisableTOTP disables TOTP
 func (c *User) DisableTOTP(g *gin.Context) {
-	_, user, ok := c.handleSession(g)
+	session, user, ok := c.handleSession(g)
 	if !ok {
 		return
 	}
@@ -866,6 +867,7 @@ func (c *User) DisableTOTP(g *gin.Context) {
 	// disable TOTP
 	err = c.UserService.DisableTOTP(
 		g.Request.Context(),
+		session,
 		&userID,
 	)
 	// handle response
diff --git a/backend/service/user.go b/backend/service/user.go
index 600dc90..9c818ed 100644
--- a/backend/service/user.go
+++ b/backend/service/user.go
@@ -791,10 +791,15 @@ func (u *User) IsTOTPEnabledByUserID(
 
 // DisableTOTP disables TOTP
 // without checking if the user privilige, use with consideration
+// session may be nil when called during a pre session flow such as
+// login with a recovery code
 func (u *User) DisableTOTP(
 	ctx context.Context,
+	session *model.Session,
 	userID *uuid.UUID,
 ) error {
+	ae := NewAuditEvent("User.DisableTOTP", session)
+	ae.Details["userId"] = userID.String()
 	err := u.UserRepository.RemoveTOTP(
 		ctx,
 		userID,
@@ -803,7 +808,7 @@ func (u *User) DisableTOTP(
 		u.Logger.Errorw("failed to disable TOTP", "error", err)
 		return err
 	}
-	// TODO audit log successful TOTP disable
+	u.AuditLogAuthorized(ae)
 	return nil
 }