April 20, 20265 min read

Audit Evidence Export and Periodic Attestation in Magellan

> Where to read this in context: the same workflow is described under healthcare framing on /audit (HIPAA + 21 CFR Part 11) and under cross-industry framing on /audit/regulated-industries (SOX, GxP, GDPR, FedRAMP, ISO 27001).

The Workflow Behind a Clean Audit

A regulator does not want a database export, and they do not want a screenshot. They want a self-verifying evidence pack signed by a named accountable individual, covering a specific time range. That requirement shows up in nearly identical language across frameworks:

HIPAA §164.308(a)(1)(ii)(D): periodic review of information system activity.
21 CFR Part 11 §11.10(j): independent review of records.
EU GMP Annex 11 §9: regular review of audit trails by an independent person.
SOX §404: management assertion with supporting evidence retained for an external auditor.
GDPR Art. 30: record of processing activities, available to a supervisory authority on request.
FedRAMP AU-6 / NIST SP 800-53: review and analysis of audit records on a defined frequency.
ISO 27001:2022 A.5.35: independent review of information security.

Magellan's Compliance Officer produces that pack on a configurable cadence — and the cadence itself is recorded in the ledger.

The Cadence

Each cycle the Compliance Officer (a named role per the seven-role RBAC model, distinct from the technical Administrator) does three things:

1. Export the ledger range for the period.

2. Verify the SHA-256 hash chain over that range.

3. Attest to the verified range with an electronic signature, written back into the ledger as its own entry.

The third step is what 21 CFR Part 11 §11.10(j), Annex 11 §9, and ISO A.5.35 all require — independent review of records — performed by a role whose mandate is *only* review.

The default cadence is quarterly. SOX-driven deployments often align with the financial close calendar; GxP deployments often align with quality-system review; FedRAMP deployments align with the continuous-monitoring frequency in their authorization package. The cadence is configurable and the configuration is itself a ledger entry.

What the Evidence Pack Contains

A Magellan evidence pack is a single signed archive containing:

The ledger range, ordered by ULID (which is also chronological order).
The hash chain — the predecessor SHA-256 for every entry in the range, including the one immediately preceding the range so the chain can be picked up cleanly.
The role grants in effect during the range, including any grants or revocations that happened *inside* the range.
The Compliance Officer's attestation entry — the ledger row that contains the e-signature covering this range.
The verification script — a small, dependency-free program that re-walks the chain and re-checks signatures. It produces the same byte-identical result on any machine.
The canonical serialization spec — so an external assessor's own tooling can produce the same hashes.

The pack is reproducible: exporting the same range twice yields byte-identical output. That property comes from the ledger being append-only and the serialization being canonical, not from Magellan being clever about diffs.

The Attestation Signature

The attestation is a two-field statement: *this Compliance Officer asserts that the ledger range [start_ulid, end_ulid] verified cleanly on this date.* The signature is a 21 CFR Part 11 §11.50-style electronic signature with the Compliance Officer's identity and the timestamp embedded. Under SOX, the same record functions as a control-evidence artifact for an ITGC walkthrough; under GDPR, it satisfies the "kept up to date" requirement of Art. 30(1).

Two properties matter:

The attestation is itself in the ledger. There is no separate "attestation log" to keep in sync. The ledger is the only source of truth.
The attestation covers a hash, not a date range alone. The signature references the hash of the range's last entry, so a later attempt to extend or alter the range would invalidate the attestation.

Retention

Retention policy is configurable, but only by the Compliance Officer — Administrator cannot change it. The default is the longer of:

Six years (HIPAA §164.316(b)(2)(i))
Seven years (SOX §103, default U.S. external-audit retention)
The full lifetime of any mapping referenced by an entry in the range
Any explicit jurisdictional override (e.g., longer GxP product-lifecycle requirements; FedRAMP authorization-period retention; ISO 27001 A.5.33 retention requirements; GDPR Art. 5(1)(e) storage-limitation rationale)

Retention changes are themselves ledger entries, signed by the Compliance Officer. Shortening retention is therefore visible and attributable; it cannot happen quietly.

What the External Reviewer Receives

When an external review happens — a HIPAA OCR audit, an FDA Part 11 inspection, a SOX external-auditor walkthrough, a GDPR supervisory-authority request, a FedRAMP 3PAO assessment, or an ISO 27001 surveillance audit — the Compliance Officer hands over:

The evidence packs covering the review window
The role grants table
The retention policy entries
The verification script

Everything else — internal mapping content, RBAC implementation details, source code — is not in scope and is not exported. This keeps the minimum-necessary boundary clean across frameworks: HIPAA §164.502(b), GDPR Art. 5(1)(c), and the FedRAMP "least functionality" principle (CM-7) all align on the same outcome — the reviewer receives exactly the evidence the review requires, and no sensitive payload.

Why This Workflow Is Boring on Purpose

A defensible audit workflow is *uneventful*. The same person, performing the same three steps, on the same cadence, producing a pack with the same shape, every period. Every novel step in an audit is a step a regulator may ask about. By making export, verification, and attestation a single repeatable workflow signed into the ledger, Magellan removes most of the surface area for those questions — whether the framework on the cover page is HIPAA, SOX, GxP, GDPR, FedRAMP, or ISO 27001.