Compliance, Audit, and Legal/Regulatory Requirements
What this domain tests
Compliance, audit, and legal and regulatory requirements tests obligations, evidence, audit process, findings, and corrective action. Expect privacy, records retention, contracts, audit independence, and regulatory reporting.
Core rules
- Compliance is meeting obligations; audit provides independent assurance against criteria.
- Internal audit should report independently; auditors should not design and implement the controls they audit.
- Audit evidence must be sufficient, relevant, and reliable; screenshots without metadata may be weak.
- Findings need root cause, risk rating, owner, and due date; corrective action is tracked to closure.
- Legal and regulatory obligations include data protection, breach notification, retention, and cross-border transfer.
- Contracts create obligations: confidentiality, notification, audit rights, and data return.
- Compliance monitoring should be continuous and risk-based, not annual paperwork.
Worked example
An audit finds unpatched internet-facing servers. The auditor records the criteria, evidence, and risk. Management performs root cause analysis: no owner for patch exceptions. Corrective action assigns an owner, sets a 14-day remediation SLA, and adds monthly reporting. The auditor verifies closure but does not patch the servers. Reasoning: independence is preserved, the fix addresses root cause, and evidence supports closure.
Traps
- Having the auditor implement the fix.
- Treating compliance as equivalent to security.
- Failing to retain evidence.
- Letting audit scope creep without approval.
- Accepting legal advice from security instead of counsel.