Legal and Regulatory Compliance

Rules from every direction

Organisations face rules from many sources: privacy laws, financial regulations, industry rules, and contracts with customers and suppliers. Breaking them can mean fines, lawsuits, or losing the right to operate.

Management is responsible for knowing which rules apply and for complying with them. Internal audit checks how well that’s done.

A compliance process

1. Identify the requirements: laws in each country, sector rules, contracts, standards the organisation has signed up to.
2. Assign owners for each requirement.
3. Map policies and controls to each requirement. One control often covers several.
4. Monitor compliance through testing and self-assessment, and track regulatory change.
5. Report status and breaches to management and the board.
6. Train staff on the rules that apply to their roles.

IT-related obligations

Area	Examples
Privacy and data protection	GDPR, national privacy laws, health data rules
Financial reporting	Sarbanes-Oxley in the US, and equivalents elsewhere
Sector regulation	Banking regulators’ IT and outsourcing rules, health data, operational resilience rules
Payment cards	PCI DSS, enforced through contracts
Intellectual property	Software licensing and copyright
Record retention	Tax, employment and industry rules on how long to keep records and how to destroy them
Electronic evidence	Duties to preserve and produce records in legal cases
Cross-border data	Limits on moving personal data abroad

The auditor’s approach

When auditing compliance, the first step is identifying which requirements apply to the organisation and the area being audited. Then the auditor:

• reviews how management identifies and tracks requirements
• checks policies and procedures reflect current rules
• tests the key controls
• consults legal counsel on interpretation, because the auditor isn’t a lawyer
• reports non-compliance to the right level of management, and to the audit committee if significant

Example. A new HR system stores employees’ health information, which privacy law treats as especially sensitive. No privacy impact assessment was done, and the compliance team didn’t know the system existed. The finding: the compliance process doesn’t catch new systems handling regulated data.

How the exam asks about it

If the question asks…	The answer is usually…
First step in a compliance audit	Identify the laws and regulations that apply
Who is responsible for compliance?	Management
The auditor is unsure how a law applies	Consult legal counsel
Control to keep policies in line with new regulation	A process for tracking regulatory change
Is PCI DSS a legal requirement?	It’s a contractual obligation, treated as a compliance requirement

In short

• Management is responsible for knowing which laws and regulations apply and for complying with them.
• A compliance process needs a list of requirements, owners, controls mapped to each requirement, monitoring and reporting.
• IT-related obligations include privacy, financial reporting (such as SOX), sector rules, card data (PCI DSS), licensing and record retention.
• The auditor's first step is identifying which requirements apply, then checking the organisation has a process to meet them.
• The auditor isn't a lawyer; legal questions go to legal counsel.
• Regulatory changes must be tracked so policies and controls stay current.

Exam traps

• The auditor's first step is understanding which requirements apply, not testing controls.
• Compliance is management's responsibility, not internal audit's.
• On suspecting an illegal act, the auditor reports it internally; they don't decide the legal outcome.
• Contractual obligations, like PCI DSS through card agreements, count as compliance requirements even though they aren't laws.

Slides

Click the slide and use the arrow keys. F toggles full screen.