The NAIC market-conduct examination request is the worst thing that lands in a carrier compliance inbox. It always reads the same way: "Reconstruct the complete decision context behind claim P-9871, as it stood on March 15th."
Three months ago. The rate table has had a Q1-to-Q2 transition since then. The policy form was updated in April. The adjuster's authority matrix changed in February. Your DBA has rolled six Postgres snapshots since the date in question. The Splunk logs from March are still searchable, but reconciling timestamps to rate-table versions is somebody else's eight-hour day.
Most carriers handle this in about six weeks. Two engineers lose a sprint. Outside counsel bills $850 an hour. By the time the response goes back, $90,000 in legal and engineering time has gone to evidence reconstruction, and you still aren't fully certain nothing in the record has been silently modified since March.
What the examiner is actually testing
The state DOI examiner isn't testing whether you adjudicated correctly. They're testing whether you can prove your records haven't been tampered with after the fact. AS-1105 in the audit-evidence world is straightforward: evidence is only admissible if you can prove it hasn't been modified.
That's three things:
- Bitemporal reconstruction. The system must answer "as it stood on March 15" — not "as it stands now," not "from a backup somebody can vouch for."
- Decision lineage. The denial cited exclusion 4.2(c). The exclusion existed in the form. The form was in force. The inspector's report supported the exclusion. All of that has to be one walk.
- Tamper-evidence. The record must be provably unmodified between the decision date and today.
If you put a bitemporal graph + a SHA-256 audit chain under your claim system, all three become one-query operations.
The one-query reconstruction
MATCH (c:Claim) AT RECORDED '2026-03-15T08:00:00Z'
WHERE c.id = 'P-9871'
OPTIONAL MATCH (c)-[:USED_RATE_TABLE]->(rt:RateTable) AT RECORDED '2026-03-15T08:00:00Z'
OPTIONAL MATCH (c)-[:UNDER_POLICY_FORM]->(pf:PolicyForm) AT RECORDED '2026-03-15T08:00:00Z'
OPTIONAL MATCH (c)-[:ADJUDICATED_BY]->(a:Adjuster) AT RECORDED '2026-03-15T08:00:00Z'
RETURN c, rt.version, pf.form_id, a.authority_grantEach MATCH clause with AT RECORDED reads the graph as it was recorded at that time: the rate table that was in force, the policy form version, the adjuster's authority at adjudication, and the denial reason as cited then. A clause without its own AT RECORDED reads current data, so the cut is repeated on each OPTIONAL MATCH.
The tamper-evidence check
The harder examiner question is: "How do we know you didn't edit the record after the fact?" The graph's write history answers it. Each node and relationship write committed through Cypher, /execute or import is appended to the history log with the SHA-256 hash of the previous record, so changing an earlier record breaks the chain. Schema, index and constraint changes are not recorded.
GET /graphs/{name}/audit/verify
→ {"status": "clean", "records": 48213, "last_seq": 48213} (illustrative values)If a record had been altered, the response is broken, with the offset and index of the first record that fails. The check covers the whole graph and has no date window. The history log is not signed or anchored outside the server, so the check does not detect a rewrite of the whole log, or removal of the most recent records, by someone with write access to the server. To show when the claim itself was written and changed, list its versions:
MATCH (c:Claim {id: 'P-9871'})
CALL db.history(id(c)) YIELD version, timestamp, validFrom
RETURN version, timestamp, validFrom ORDER BY versionThe lineage walk
The third examiner question is "show us the inputs." db.derivedFrom('denial:P-9871', 3) follows DERIVED_FROM edges from the denial to the sources recorded for it. The denial cites exclusion 4.2(c). The exclusion derives from the policy form, which carries its filing date with the state DOI. The inspector's report — signed and dated by the inspector — supports the exclusion citation. The photo set referenced by the report is one more edge away.
The examiner can run the same queries against the same deployment.
The numbers
The figures in this post and in the walkthrough are illustrative. The history check shows whether any committed record was altered in place after it was written; whether that meets a particular evidence standard is for your examiner or auditor to decide.