The Deferred Audit Log
Vantage Health is six weeks from go-live of a patient scheduling platform. A new interpretation of an existing regulation now requires immutable audit logs for all administrative changes to appointment templates, including who changed what and when. The current design logs only user ID and timestamp. The delivery team estimates three weeks to add immutable storage, retention, and reconciliation reports. The compliance officer says the requirement applies from day one. The operations director proposes a manual weekly reconciliation for phase 1 and full logging in phase 2, three months later. The change control board has not met, and the vendor contract has a 10-business-day impact-assessment window. Two hospitals are already training staff on the phase 1 process. The risk register rates regulatory breach as high impact and medium likelihood.
1. Assess the proposed deferral and recommend a disposition to the change control board.
Read the worked answer
The deferral should not be approved as proposed. The regulatory interpretation applies from day one, so a phase 2 implementation leaves a known compliance gap for three months. The manual weekly reconciliation does not replace immutable logging: it detects some discrepancies after the fact, cannot reconstruct who changed what, and depends on staff remembering to run it. It is a compensating control at best, not an equivalent control.
The board should compare three options:
- Delay go-live by three weeks and implement immutable logging before launch. This preserves compliance but affects two hospitals already in training and may create operational disruption.
- Limit phase 1 scope so administrative template changes are disabled or restricted to a small controlled group until logging is available. This may allow go-live for scheduling transactions while avoiding the unlogged activity.
- Proceed with manual reconciliation and formal risk acceptance. This is only credible if compliance signs the residual risk, the reconciliation is daily rather than weekly, and the phase 2 date is funded and contracted.
The recommendation is option 2 if the restricted scope is technically feasible, otherwise option 1. Deferral without compliance sign-off is not a controlled change; it is an unaccepted regulatory exposure.
2. How should the change be processed through governance, and what should happen with the hospitals already in training?
Read the worked answer
The change should enter the change control board with a complete impact assessment, not an informal estimate. The assessment should cover the three weeks of delivery effort, the immutable storage and retention design, the reconciliation reports, the effect on the go-live date, the contract change request under the 10-business-day window, and the regulatory consequence of each option. The compliance officer should state in writing whether the requirement is mandatory from day one and what evidence would satisfy it. The risk register entry should be updated with the chosen response and the residual risk owner.
The hospitals need a single, consistent message rather than a rumour. The program should tell them which option is being decided, the date of the decision, and the impact on training and go-live. If the decision is to restrict administrative template changes, training should be adjusted to the restricted process. If the decision is to delay, the hospitals need a revised schedule and support plan. The worst outcome is to let training continue on a process that governance may not approve, because that creates commitment to an unapproved design and makes the eventual change harder.