Top 5 Audit trail Interview Questions
Browse 5 real-world technical and behavioral interview questions about Audit trail. Review scenarios, edge cases, and architectural best practices.
You need to change a field on a live trial's data capture system. What evidence does that change have to produce?
A change to a validated system needs a documented requirement, an assessed risk and impact, approved test evidence that the change does what was specified, an intact audit trail over any affected data, and an approval record showing who authorised release. Working code is not evidence.
A legal hold lands on Friday afternoon and your nightly deletion jobs run at two. What do you do, and what do you build afterwards?
Suspend deletion only for the scoped records, not everywhere, which means hold has to be a first-class state that overrides the retention schedule. The engineering work is scoping the hold, suppressing every deletion path including backup expiry, and paying down the deletion debt that accumulates once the hold lifts.
The operations team says there is no rule for this, they just use judgement. How do you model that?
Judgement is an unwritten rule plus a genuine discretion, so separate the two. Sample real decisions to find the factors deciding most cases, automate the unambiguous ends, and model the discretionary middle as a recorded decision carrying its inputs, recommendation and reason.
How do you design a system so an auditor can prove who accessed a record and why?
You need a purpose-built audit trail, not application logs: guaranteed-capture, append-only records of actor, subject identifier, action, server time, outcome and stated purpose, made tamper-evident by hash chaining and anchored write-only storage, and held where whoever can change the data cannot change its record. It also connects access control to the point an interviewer is testing.
A trial site records a visit on a paper worksheet and types it into your system a week later. What has to be true for that data to count?
The worksheet has become source data, so it must be retained, attributable and legible, and the electronic entry must carry the date of the visit separately from the date of entry. What makes the data usable is the audit trail and the query history, not the value in the field.