Two practices get the same request from an auditor, a carrier or opposing counsel. One answers it that afternoon. The other spends three weeks on it, pulls two people off client work, and produces something hedged. The usual explanation is that the first one is better organized. That is not really it.
The difference is almost always decided long before the request arrives. It is whether the thing being asked about was recorded at the time it happened, or has to be reconstructed afterwards from memory, mailboxes and inference.
Questions a system can answer
We timed a few audit-shaped questions against our own systems this week, because the claim is easy to make and worth measuring.
"How many requests did this service handle in the last thirty days, and to which paths?" — 75,961, answered in four milliseconds. "Was any administrative surface reached from outside in the last ninety days?" — 682 attempts, answered in twenty-four milliseconds. "Prove mail authentication has been correctly configured" — under half a second. "Has this control ever failed, and how often?" — 22 successes in 100 runs, answered in about two seconds.
None of that is impressive engineering. Every one of those answers exists because something wrote a line to a file at the moment the event happened, and the lines are still there in a shape a query can reach. The speed is a consequence of the recording, not of the searching.
Questions the same systems cannot answer
The same audit produced three questions we could not answer quickly, and they are more instructive than the ones we could.
"When was a backup last restored?" Before this week, never — and there was no record of that either way. The absence of restores and the absence of a record of restores are indistinguishable, so the honest answer to an auditor is "we do not know", which is a bad sentence to have to say.
"Which configuration change caused this process to start failing?" Our automation configuration was not under version control. Zero history. That question — what changed, when, and who decided it — is among the most common things an auditor, an insurer or a lawyer will ask, and without version control there is no answer, only recollection. The fix costs nothing: putting a configuration directory under version control is a five-minute job that converts an entire class of unanswerable question into a one-line command.
"Who accessed mail over the last ninety days?" Partially answerable. The logs retain some of it, and the retention window was set by a default nobody chose deliberately. That is the most common shape of this problem: not missing logging, but logging that expires shortly before the period anyone asks about.
The three-week answer is archaeology
When the record does not exist, the work does not disappear — it moves. Somebody searches mailboxes for a decision, asks a colleague what they remember, opens a spreadsheet last touched two years ago, and assembles a narrative that is probably true. That is archaeology, it takes weeks, and it produces an answer with hedging in it because the person writing it knows what they had to infer.
The cost is not only the three weeks. A reconstructed answer is weaker in exactly the situation where strength matters. "Our logs show no administrative access from outside this range, here is the query" is a different kind of statement from "we are not aware of any", and everyone in the room knows it.
What to change before anyone asks
The useful exercise is not buying a compliance product. It is writing down the five questions you would most dread being asked, then checking, today, whether each one is a query or an excavation. Most practices already know their five. Access to client records, changes to who could see what, when a particular thing was last verified, what was done after an incident, and what changed in the systems and when.
For each one that turns out to be an excavation, the fix is almost never a new platform. It is usually that something is already producing the information and nobody keeps it, or that a retention window is shorter than the period people ask about, or that a decision is recorded in an inbox rather than anywhere durable.
Version control for configuration is the highest-return item on that list and the one most often missing. It answers what changed, when, in what order, and it does so with a timestamp nobody can quietly edit afterwards. We were missing it in one place and found it during our own audit, which is the ordinary way these things are found — by looking, before someone else does.
Working on something where this kind of thinking matters? Get in touch.