Auditability & Evidence interview questions

Audit trails versus logs, tamper-evidence, retention, and what an auditor actually accepts.

3 questions in Regulation & Compliance.

Regulation & ComplianceA 22-minute read on how the topic fits together, before the questions.Regulation and compliance fundamentals58 short answers on one page, for revising rather than studying.

medium1

mediumDesignConceptScenario

How do you design a system so an auditor can prove who accessed a record and why?

You need a purpose-built audit trail, not application logs: guaranteed-capture, append-only records of actor, subject identifier, action, server time, outcome and stated purpose, made tamper-evident by hash chaining and anchored write-only storage, and held where whoever can change the data cannot change its record. It also connects access control to the point an interviewer is testing.

8 minmid, senior, staff

hard2

hardScenarioDesign

A legal hold lands on Friday afternoon and your nightly deletion jobs run at two. What do you do, and what do you build afterwards?

Suspend deletion only for the scoped records, not everywhere, which means hold has to be a first-class state that overrides the retention schedule. The engineering work is scoping the hold, suppressing every deletion path including backup expiry, and paying down the deletion debt that accumulates once the hold lifts.

6 minsenior, staff, lead

hardDesignScenario

An auditor wants proof that a control operated on every day of the review period, not that it exists today. What do you show them?

Evidence of operation is a by-product of the control running, not a screenshot taken during the audit. Design each control so it emits a dated, attributable artefact you cannot backfill, and be able to argue completeness rather than just show samples.

6 minsenior, staff, lead