I'm not sure I understand: why can't they record the decrypted traffic instead? (I assume they have it plain text at some point). Of course they could encrypt i

I'm not sure I understand: why can't they record the decrypted traffic instead? (I assume they have it plain text at some point). Of course they could encrypt it again before sending it to their audit server