Security is a claim.
Evidence is the product.

Your audit log is a story, not evidence

Most audit trails are rows in a table the operator can edit. That gap stays invisible until the day it matters — and by then the log is all anyone has.