The Regulator, the Delay, and the Helpful Stakeholder
You are managing a clinical-records system replacement for a hospital network. A regulator has requested evidence that data integrity controls were tested before cutover. Testing is 70% complete and on schedule. The hospital's chief operating officer, who is also your executive sponsor, asks you to send the regulator a summary stating that 'integrity controls have been validated' because the remaining tests are 'low risk and obviously going to pass.' The COO wants to avoid a two-week delay to a board presentation. You have the actual test log: 14 of 20 controls passed, 4 failed and were remediated, and 2 have not run. One of the unrun tests concerns audit-trail completeness on record deletion.
1. What do you do about the COO's request?
Read the worked answer
Do not send a statement that controls 'have been validated.' That is factually false: 2 of 20 have not run, and one of those covers audit-trail completeness on deletion, which is exactly the kind of control a regulator cares about. Sending it would be a misrepresentation to a regulator, and in a clinical-records context it carries legal and patient-safety exposure.
Response to the COO: acknowledge the board timing pressure, then offer an accurate alternative. Send the regulator a factual status: 18 of 20 controls tested, 4 failures remediated with evidence, 2 scheduled with dates, overall assessment pending. That is a defensible statement that does not overstate.
If the COO insists on the original wording, escalate - to the compliance officer or general counsel - and document the request and your refusal in writing. Do not let the request sit unresolved until the deadline forces a bad decision.
2. Can the two remaining tests be accelerated to protect the board date?
Read the worked answer
Possibly, but only if acceleration does not compromise the evidence. Assess:
- Can the audit-trail deletion test run in parallel with remaining work rather than sequentially? If yes, it may fit within days.
- Does it require production-like data or a stable environment? If the environment is not ready, acceleration is not real.
- Would a shortened test window weaken the evidence the regulator receives? A rushed test that misses edge cases is worse than a documented delay.
If the tests can genuinely run in the next five days, propose that to the COO with a firm date and a commitment to send the regulator the completed result. If they cannot, say so and propose sending the interim factual status now plus the final result when complete. Either path preserves accuracy. What you must not do is let a schedule preference drive the wording of a regulatory statement.