The compliance reconstruction question — what the auditor asks

Compliance is not a documentation problem. It is a reconstruction problem. The test is not “do we have the records?”; the test is “given a deployment running in production today, can we answer every question an auditor will ask, from a fresh terminal, in under five minutes?”. The records exist in most teams; the ability to query them is what most teams lack. This lesson names the question and the six categories it falls into.

What the auditor asks

When an auditor opens with “tell me about change CR-4471”, they are asking the team to reconstruct, from a fresh terminal, six categories of fact about a change that happened six months ago:

flowchart LR
    Q["Auditor question:\nchange CR-4471"] --> WHO["WHO"]
    Q --> WHAT["WHAT"]
    Q --> WHEN["WHEN"]
    Q --> WHY["WHY"]
    Q --> HOW["HOW"]
    Q --> AUTH["AUTHORITY"]
    WHO --> R1["Author, approver, deployer"]
    WHAT --> R2["Commit, artifact, manifest"]
    WHEN --> R3["PR open, merge, CI, deploy"]
    WHY --> R4["Ticket, risk, postmortem"]
    HOW --> R5["Pipeline, runner, environment"]
    AUTH --> R6["Reviewers, policy, board"]

The six categories cover every question a regulator asks under SOX, PCI-DSS, SOC 2, ISO 27001, or internal audit. The categories do not change with the framework; the evidence the auditor accepts changes. SOX wants segregation; PCI-DSS wants the change window; ISO 27001 wants the risk acceptance. The categories are stable.

Why “we have the logs” is not an answer

A folder of CloudTrail logs, a Confluence page, a shared drive of change tickets, and a chat thread are not, together, an audit trail. An audit trail is the queryable connection between those stores that lets the team answer one auditor question without opening five tools.

The reconstruction question is the test because it is the only one that survives a real audit. A real auditor does not accept “we have the logs”; a real auditor asks “show me”. The team that can show, from a fresh terminal in five minutes, has an audit trail. The team that has to escalate or open three systems does not.

The six categories collapse to two stores

The six categories look like six queries against six tools, but they collapse to two stores in a well-designed pipeline: the version-control repository and the deployment controller. The repository answers WHO, WHAT, WHY, and (via the PR reviewers and branch policy) AUTHORITY. The controller answers WHEN and HOW. The CI run log is the join between the two stores.

A third store (a separate change-management database, a separate approval system, a separate audit log) is implicitly admitting that the two stores plus the join do not answer all six. The right fix is to make the two stores plus the join answer all six; the wrong fix is to add a third store.

Production discipline

1. Six categories, two stores. If a third store is needed, the architecture is wrong.
2. Time-to-answer is the metric. Under five minutes per question. Measured quarterly.
3. Reconstruction is the only test. A posture that cannot survive a fresh-terminal drill has not built the posture.
4. The auditor is not the test; the reconstruction is. Build for the drill.

Cross-course references

• This course, Part LXIV (Auditability) established the audit chain that answers WHAT and WHEN.
• This course, Part CXVI (Governance) framed the controls that produce AUTHORITY.
• Terraform for Production Sysadmins - Part XI (StateAuditing) covers WHAT for infrastructure.

Quiz