@Keiran by default

/etc/security/audit_control

has read-only set. You can do

chmod 600 /etc/security/audit_control

, edit file,

chmod 400 /etc/security/audit_control

.

ls -l /etc/security/audit_control
-r--------  1 root  wheel  358 Feb 22  2019 /etc/security/audit_control