April 20, 20265 min read

What an Auditor Actually Sees in Magellan — Across HIPAA, SOX, GxP, GDPR, FedRAMP, and ISO 27001

> Where to read this in context: healthcare framing on /audit (HIPAA + Part 11), cross-industry framing on /audit/regulated-industries (SOX, GxP, GDPR, FedRAMP, ISO 27001).

The View From the Other Side of the Table

Most "audit-ready" claims are written from the engineer's perspective: which logs exist, which encryption is enabled, which backups run. That isn't what an external assessor is doing in the room. An assessor is asking specific questions and grading the time-to-evidence.

The interesting observation across regulators: the first three or four questions are nearly identical. A HIPAA OCR auditor, a SOX external-audit walkthrough lead, an FDA Part 11 inspector, a GDPR supervisory-authority case officer, a FedRAMP 3PAO assessor, and an ISO 27001 surveillance auditor all open with versions of "show me the change history," "prove it hasn't been tampered with," "show me segregation of duties," and "show me your periodic review." The cover page differs; the questions don't.

This post walks the questions in the order they actually get asked.

Question 1: "Show me every change to record X over the period."

The Compliance Officer opens Magellan's ledger view, filters by mapping ULID and date range. Result: a chronologically ordered list — guaranteed in order because the ULID primary key *is* the chronological order, not a separate timestamp column. Every row shows actor, role-at-time-of-action, action, and signature.

Time to evidence: under one minute. No log-parsing, no clock-skew caveats. This is the answer to HIPAA §164.312(b), SOX §404 change-management evidence, Part 11 §11.10(e), GDPR Art. 30 (record of processing activities), FedRAMP AU-2/AU-3 (event logging and content), and ISO 27001 A.8.15 (logging).

Question 2: "Prove this row hasn't been edited since it was written."

The Compliance Officer exports the ledger range. The export includes the SHA-256 hash chain. Anyone with the export — including the assessor's own tooling — can re-walk the chain and confirm every hash matches. If a single character had been altered, every hash from that row forward would fail.

Time to evidence: the duration of the verification script. This satisfies 21 CFR Part 11 §11.10(e), NIST SP 800-53 AU-9 ("Protection of Audit Information"), ISO 27001 A.8.15, and the integrity component of SOX ITGCs without anyone having to argue about it.

Question 3: "Who approved this release? Were there two people?"

The release entry has two signatures: the Contributor's draft signature and the Approver's release signature. The Approver is a different user than the Contributor — Magellan's RBAC enforces that a release cannot be signed by the same identity that drafted it.

Time to evidence: visible in the same ledger row. This satisfies 21 CFR Part 11 §11.200's two-component requirement, the four-eyes control in SOX change-management ITGCs, FedRAMP AC-5 (separation of duties), and ISO 27001 A.5.3 (segregation of duties).

Question 4: "Can the administrator read or alter the audit ledger?"

The answer in Magellan is no, and the proof is the role's own definition (see the seven-role RBAC model). Administrator manages platform configuration; it cannot read mapping content, cannot read the audit ledger, and cannot grant Auditor / Compliance Officer / Security Officer roles. The role split is enforced by row-level security policies, not by application code that has to remember.

Time to evidence: a single role-grant query and a policy listing. This satisfies HIPAA §164.308(a)(3), SOX SoD requirements, FedRAMP AC-6(7) ("Review of User Privileges"), and ISO 27001 A.5.18 ("Access rights").

Question 5: "Show me your periodic attestation."

The Compliance Officer's attestation is itself a ledger entry — a row with the Compliance Officer's signature covering a specific ledger range. There is no separate "attestation log" to keep in sync with the ledger; the attestation lives inside the thing it is attesting to.

Time to evidence: filter ledger by entry type = attestation. This satisfies 21 CFR Part 11 §11.10(j), EU GMP Annex 11 §9, FedRAMP AU-6 (audit record review), and ISO 27001 A.5.35 (independent review).

What Changes Across Frameworks

Almost nothing about the workflow changes; only the cover page and the cadence change. Some specifics:

HIPAA OCR audit. The §164.312(b) "audit controls" requirement is the headline, and the assessor will additionally ask about §164.502(b) minimum-necessary — answered by the fact that the ledger references payloads by ULID rather than embedding them.
SOX walkthrough. The external auditor maps each ledger property to an ITGC: change management (Q1, Q3), logical access (Q4), and monitoring (Q5). The same evidence pack supports each.
FDA Part 11 inspection. Add Q3a: "Show me the e-signature manifestation." Magellan's signature manifestation is the entry itself, displayed with signer identity, datetime, and meaning of the signature per §11.50.
GDPR supervisory-authority request. Add Q6: "Show me the lawful basis recorded for the processing activity referenced by this entry." Magellan stores the lawful-basis tag on the mapping; the ledger references the mapping ULID.
FedRAMP 3PAO assessment. The assessor maps the same five questions to AU-2, AU-3, AU-6, AU-9, AU-10, AU-11, AC-5, AC-6. The evidence pack covers each control with the same artifacts.
ISO 27001 surveillance audit. Annex A.8.15, A.5.3, A.5.18, A.5.35 are the relevant controls. The auditor will additionally ask for the documented Information Security Management System (ISMS) procedure that names the Compliance Officer; that document references the ledger as the system of record.

What the Assessor Walks Out With

A single signed evidence pack containing:

The ledger range, in chronological order
The SHA-256 hash chain for that range
The role grants in effect during that range
The attestation entries covering that range
A verification script that re-walks the chain

That pack is reproducible. Two different exports of the same range produce byte-identical evidence — because the ledger is append-only and the chain is deterministic.

Why This Matters

The shortest defense of any audit system is: *the evidence already exists in the form the assessor needs it*. Magellan's design choices — ULID keys, hash chain, role-at-time-of-action, two-component signatures — exist so the answer to every question above is a query, not a project. That property is framework-agnostic.