Compliance by design: the seven things auditors ask for

Compliance work has a predictable shape. A deal requires a security questionnaire, or a certification programme starts, or a regulator writes — and a list of requirements arrives that would have cost a week each during the build and now costs a quarter, because several of them change how data is written.

The useful observation is that the list barely varies. SOC 2, ISO 27001, GDPR, India's DPDP Act, HIPAA and most enterprise procurement questionnaires ask for overlapping capabilities in different vocabulary. Build the underlying seven and you are largely answering all of them.

1. Authorisation enforced on the server, per record

The most common serious finding in the audits we run is authorisation implemented in the interface only: the button is hidden for non-admins, and the endpoint it calls is not protected. Permissions belong in the data access layer, checked on every read and write, with tests that assert a user cannot reach another tenant's or another department's records.

2. An append-only audit trail

Who changed what, when, from where, and what the previous value was. Append-only, so it cannot be edited by the application that writes it, and covering reads of sensitive data as well as writes. This is the single most-requested artefact and the hardest to produce after the fact, because the history simply does not exist.

The design that makes this natural is to treat state changes as recorded events rather than in-place updates on a row. You get the audit trail as a property of the write path rather than as a parallel logging system that will drift out of sync with reality.

3. Classified data with a retention rule

A written inventory of every personal or sensitive field, what it is for, the legal basis for holding it, and how long it may be kept — then retention enforced as scheduled deletion rather than described in a document. Keeping everything forever is the default and is indefensible under most modern regimes, as well as being the thing that turns a small breach into a large one.

4. Access that can be granted and revoked cleanly

Auditors ask who has access to production, how they got it, and how it is removed when someone leaves. That means role-based rather than individual grants, access through an identity provider you can disable centrally, time-bound elevation for break-glass work, and an access review you can actually produce on request.

5. Encryption, with key handling described

In transit is table stakes. At rest matters, and the question that follows is always about the keys: where they live, who can reach them, and how they rotate. Managed key services answer this well; a passphrase in an environment variable committed two years ago does not.

6. A change trail from request to deploy

Every production change traceable to a reviewed pull request, a passing pipeline, and a person who approved it. This is one of the few requirements that is nearly free if you already work this way and awkward if you do not — and it is why a CI pipeline that blocks merge is a compliance control, not just an engineering convenience.

7. A restore you have actually performed

Not a backup — a restore. Timed, documented, and rehearsed, with a stated recovery point and recovery time objective. An untested backup is a belief. Every organisation with a serious data loss story had backups.

Compliance is mostly the discipline of being able to demonstrate what you already claim to do. If the demonstration is hard, the claim is usually weaker than you think.

What this does and does not get you

Building these does not make you certified. Certification requires an audit against a defined scope, evidence over an observation period, and policies covering people and process as well as software. What it does is make that exercise a documentation project rather than an engineering project — which is the difference between a few weeks and a couple of quarters.

It also removes a specific commercial risk. Enterprise procurement increasingly asks these questions before signing, and the deals lost to a security questionnaire are lost quietly, months after the software decision that caused it. Establishing which regimes apply to you in the first week of a build costs almost nothing and is the highest-leverage compliance decision available.