Regulatory and Standards Compliance
What compliance means
Compliance auditing tests whether the organisation meets applicable laws, regulations, standards, and internal policies. Candidates must distinguish mandatory requirements (laws, regulations, contractual obligations) from voluntary standards (frameworks and good practice) and know that the audit criteria must come from an identifiable source - a law, a standard, a policy, or a contract.
Standards and frameworks
Understand the role of professional auditing standards (which govern how audits are performed) versus control frameworks (which describe what good control looks like). Know that standards typically require auditors to comply with ethical requirements, plan and perform the engagement to obtain sufficient appropriate evidence, and document the work. Familiarity with the general structure of standards - planning, evidence, reporting, quality - is more useful than memorising clause numbers.
Traps to watch
- Auditing against a standard the organisation has not adopted, without saying so.
- Confusing a regulation (mandatory) with a framework (guidance).
- Assuming compliance with one standard means compliance with another.
- Missing that a requirement changed during the audit period - check the version in force at the time.
Rule of thumb
Every compliance finding needs a named criteria source with a version and date. If you cannot cite the requirement, you cannot assert non-compliance.
Worked example
An auditor finds that records were retained for three years, while a regulation requires five. The finding cites the specific regulation and the period in force. If the regulation changed mid-year, the auditor must test against the requirement applicable to each period, not a single blanket rule.