If an Admin Can Edit the Log, It Isn’t Evidence: Building an Audit Trail Regulators Actually Trust

Introduction Most organisations can produce an audit log when asked. Far fewer can answer a harder question: could someone with administrative access have quietly edited that log before producing it. If the answer is yes, even in theory, the log is not evidence.