Original Audit Data Should Stay Immutable

Estimated reading: 1 minute 5 views

Overview

Original audit data should not be edited after it is created.

Why

It protects audit credibility.
It supports investigations.
It separates evidence from review workflow.
It makes integrity checks meaningful.

Do not edit

User ID.
Action.
Timestamp.
IP address.
Old value.
New value.
Entity ID.
Original payload.

Use instead

Notes for explanations.
Tags for classification.
Reviewed status for workflow.
Archive status for storage management.

Example

If an old entity title looks confusing, add a note explaining the current context instead of editing the original event.

CONTENTS