Application "tripwires" are just another obstacle for an attacker to overcome. If audits aren't external to the system being audited they're just as vulnerable

Application "tripwires" are just another obstacle for an attacker to overcome. If audits aren't external to the system being audited they're just as vulnerable to manipulation. A Customer of mine in the financial sector sent their backups to a third-party for independent verification quarterly. The third-party restored data into a clean system reconciled against the production system. That would be the kind of auditing that would be more apt to detect the "low and slow" attack.