diff --git a/sys/security/audit/audit.h b/sys/security/audit/audit.h
index 08bebcde8fb7..e6e0cb72c628 100644
--- a/sys/security/audit/audit.h
+++ b/sys/security/audit/audit.h
@@ -202,7 +202,7 @@ void	 audit_thread_free(struct thread *td);
  * possible that an audit record was begun before auditing was turned off.
  */
 #define	AUDIT_SYSCALL_EXIT(error, td)	do {				\
-	if (audit_enabled | (td->td_ar != NULL))			\
+	if (audit_enabled || (td->td_ar != NULL))			\
 		audit_syscall_exit(error, td);				\
 } while (0)