Three seconds apart: testing the clock assumption behind an incident finding

A successful login record is timestamped 09:09:12. A process-execution record is timestamped 09:09:15. The recorded timestamps are three seconds apart. Does that establish that the process followed th