Why an audit trail must be append-only
If a record can be quietly rewritten, its value as evidence is zero — including the parts nobody rewrote.
The property is all-or-nothing
An audit trail's usefulness rests on one assumption: that what it says happened, happened. Allow editing anywhere and that assumption fails everywhere, because a reader cannot tell the untouched entries from the adjusted ones.
This is why append-only is not a strictness setting to dial up for regulated clients. A partially mutable log is not a weaker audit trail; it is a different and much less useful thing wearing the name.
Corrections are entries, not edits
Mistakes obviously happen — a document approved against the wrong transaction, a memo written about the wrong line. The answer is not to make the record editable. It is to record the correction.
A correction is a new entry that supersedes an earlier one, and both stay visible. The current state is clear, and so is the fact that it changed and when.
That history is frequently the interesting part. Knowing a figure was revised twice before close tells a reviewer something that a clean final value never would.
It has to answer who, what, when and why
Who changed it and when are the easy parts; most systems capture those. What specifically changed and why are the parts that get dropped, and they are the parts a question six months later actually needs.
So approvals and rejections carry memos, and the entry records the decision rather than just the mutation. "Jane approved this" is weaker than "Jane approved this, against this transaction, with this reason, on this evidence."
Isolation is part of it
An audit trail that spans clients is a leak. Every client is its own organization with its own documents and its own membership list, and the trail follows that boundary.
One client's history is never visible from another's — not filtered out of the view, but outside it.