Use when audit logs need tests for HIPAA, PCI DSS, SOC 2, GDPR or another framework: the required events (logins, privilege changes, data access, admin actions, exports), structured log format, tamper-evident hash chains, immutability and retention, and replaying logs for forensics.