Compliance Audit Guide

The regulatory compliance rules and audit requirements that organizations are required to abide by are dictated by their industries and/or the governmental mandates that apply to them. A compliance audit identifies issues within an organization that can lead to a wide range of problems with varying degrees of severity.

A compliance audit entails a review of an organization’s policies, procedures, processes, files, documentation, and records to evaluate their alignment with compliance standards or rules. Failure to comply with requirements can result in failure to pass a compliance audit, leading to a follow-up audit to assess remediation of issues and/or fines.

What Is a Compliance Audit?

A compliance audit is an in-depth assessment of an organization’s adherence to legal requirements and required standards as well internal policies and procedures. Compliance audit reports document the extent of compliance by evaluating and measuring areas across an organization, including the efficacy of processes, policies, security controls, risk management procedures, reporting, and other documentation.

The final compliance audit report will call out gaps in compliance and include recommendations to resolve issues.

Compliance audits can be either an internal or external process.

• External audit
  A formal compliance audit is carried out by an independent third party or representative from the agency that oversees a regulation, such as the Food and Drug Administration (FDA), Environmental Protection Agency (EPA), or the PCI Security Standards Council (PCI SSC). An external compliance audit will follow a specific format based on the compliance regulation or the rule being assessed.  

• Internal audit
  An informal compliance audit is conducted to objectively assess an organization’s risks, controls environment, operational effectiveness, and compliance with applicable laws and regulations. An internal compliance audit can also include a review of internal controls around corporate governance, accounting, financial reporting, security, and IT.  

Benefits of compliance audits include:

• Avoid penalties and legal issues  
• Comply with laws  
• Ensure business continuity 
• Help reduce risk 
• Identify weaknesses  
• Maintain a good brand reputation 
• Prevent disruptions or cessation of operations
• Provide a safe working environment  
• Retain public trust  
• Support transparent reporting

Purpose of a Compliance Audit

The purpose of a compliance audit is to validate an organization’s adherence to the rules required by applicable regulations, standards, and internal directives (e.g., bylaws, codes of conduct, processes, procedures). Conducted by internal teams, independent third parties, or regulators, a compliance audit provides visibility into areas of noncompliance that require remediation to avoid issues and potential fines.

A compliance audit also helps to identify gaps related to changes in rules or new mandates. Other reasons for a compliance audit include the following:

Assessment of the Effectiveness of Processes

One of the main reasons for conducting a compliance audit is to review and determine the efficacy of an organization’s compliance practices and protocols. During examinations of processes, a compliance audit can determine if it meets established standards.

Identification of Deficiencies in the Compliance Program

If gaps or issues are identified during a compliance audit, the resulting report will include documentation that details the deficiencies and/or weaknesses. It also provides recommendations for remediation related to the compliance program. Often, current processes may be operating effectively, but the compliance program may not have kept up with rapidly-evolving regulations.

In this case, a compliance audit helps an organization to understand weaknesses or deficiencies, including possible reasons for their occurrence and potential consequences or ramifications, along with recommendations to get the program updated and in line with the latest requirements.

Verification of Remediation

Sometimes, when an organization’s compliance program and/or internal processes are found to have issues, remediation is mandated. If included as part of a compliance audit process, issue remediation is usually referred to as CAPA: Corrective Action/Preventive Action.

In the event that a compliance audit results in the issuance of CAPA, verification is required—either a specific deadline is set and a follow-up visit scheduled, or the issue is noted for reevaluation at the next regular compliance audit.

Compliance Audit Criteria

Regulatory authorities are the most fundamental element of compliance auditing criteria. The various regulatory authorities establish and enforce the compliance audit criteria’s structure and content, which can include rules, laws and regulations, guidelines, policies, and established codes of conduct. 

Government authorities are mostly created and run according to local, state, or federal legislation. In other cases, regulations are created and enforced by organizations that span multiple countries, such as the General Data Protection Regulation (GDPR), which was created by the European Union (EU) and the European Economic Area (EEA), or the International Medical Device Regulators Forum (IMDRF), which is a consortium of countries from around the world.

Compliance audit criteria provide benchmarks for consistently evaluating or measuring the adherence to rules. A review of relevant authorities and rules dictates the criteria to be used for a compliance audit. Regardless of the authority or its rules, compliance audit criteria must be:

• Acceptable 
• Available  
• Comparable
• Complete
• Objective
• Relevant
• Reliable
• Understandable

The primary objectives of compliance audit criteria are to assess an organization’s: 

• Understanding of and compliance with the requirements
• Establishment and maintenance of effective controls 
• Ability to take corrective action when instances of noncompliance are identified, along with a record of remediation tactics

The criteria for a compliance auditor include having the ability to:

• Identify audit and reporting requirements  
• Obtain sufficient evidence to make a determination of compliance
• Perform procedures to ensure that organizations address gaps  
• Report on whether the entity complies at the level specified in the compliance audit requirements

Participants In a Compliance Audit

Compliance auditing participants include three key parties:

1. Auditor
The auditor’s objective is to collect evidence to support a decision about an organization’s compliance status. As part of a compliance audit, the auditor’s responsibility is to identify the audit elements, assess whether particular subject matter is compliant with the established criteria, and issue a compliance audit report.

2. Responsible party
The responsible party is the agency, organization, or group that oversees compliance (e.g., FDA, EPA). In compliance auditing, the responsible party determines the subject matter of the audit.

3. Intended users
The intended users are the individuals, organizations, or classes for whom the compliance audit report is created. The intended users generally include the legislators or organization heads who represent the public for compliance auditing. Responsible parties also are users of the audit data, as they are responsible for mandating remediation or assessing fines in the event of noncompliance.   

Within the two types of compliance audits, internal and external, the composition of the participants is as follows:

• Internal compliance audit teams
  An internal compliance audit team will vary based on the organization and the type of audit. Most internal audit teams include employees from within the organization who are tasked with evaluating the effectiveness of a particular department or compliance initiative.
  
  Internal audit teams document their observations and report their findings to appropriate management for review. The objective of the internal audit teams is to gauge the organization’s compliance, assess overall risks related to noncompliance, and identify areas that require improvement. 
  
  As such, when assembling an internal compliance audit team, it is important that the members are not only detail-oriented, but also have a solid understanding of the applicable regulations and the organization’s related responsibilities.

• External compliance audit teams
  An external compliance audit team consists of specialized professionals who represent the governing or regulatory body conducting the audit. As with an internal compliance audit, the participants will vary according to the industry and scope of the audit.
  
  Typically, an external compliance audit team includes specialists in the area upon which the audit focuses, such as accountants, security analysts, manufacturing experts, or IT specialists. In some cases, these are independent third parties, or they can be employees of the organization that’s leading the audit (e.g., FDA, EPA).
  
  External compliance audit teams report their findings to their respective regulatory organizations and the organization that is being audited. External audits are particularly important because they measure if an organization is complying with state, federal, or corporate regulations, rules, and standards. The results can carry the threat of fines or legal action with them.

Third parties are sometimes brought in to support the project for internal and external compliance audits. This is done for a variety of reasons, including:

• Lack of internal resources to manage the compliance audit
• Need for specific expertise that’s required for an assessment
• Desire for independent observations or oversight

Compliance Audit Challenges

Confusion About Ongoing vs. Point-in-Time Audits

Some compliance audits (e.g., PCI DSS) take place once a year when an auditor reviews controls and documentation. Other compliance audits (e.g., SSAE 16/18, Sarbanes-Oxley) require that controls operate consistently over a period of time and that the organization maintain proof of this.

Failure to Follow Through on Remediation Commitments

CAPA is key to a successful compliance audit. Creating and executing policies for remediation ensures that issues are rectified, and any compliance audit follow-up by external auditors will go well. A lack of follow-through on remediation can result in a loss of trust not just with the auditor, but with employees and customers. 

Finger-Pointing Rather than Focusing on Lessons Learned

Rather than spending energy placing blame, dig into why the issue occurred and how it can be prevented in the future. Issues can also be warning signs of bigger problems by internalizing the flagged issue and identifying and resolving adjacent gaps. 

Inconsistent Documentation

Records and documentation must be consistent and include contemporaneously documented dates, times, and details to validate that compliance criteria were met. 

Lack of Executive Commitment

Management must embrace the importance of compliance for it to permeate an organization’s culture. A successful compliance audit requires the commitment of an entire organization. 

Since compliance audits cover most parts of an organization, everyone needs to understand why compliance is required and share a commitment to strive for it.

Management’s support of compliance is also critical, because of the resources and participation that are required to meet compliance audit requirements.

Missing Documentation

With a compliance audit, documentation and supporting records are vital. Documentation lays out the processes, policies, and records that prove adherence to rules during a compliance audit (i.e., providing a paper trail). Verbal confirmation that something happened is not acceptable. 

A must-have to pass a compliance audit is written policies and procedures backed by records that display that they were followed (e.g., notices, email confirmations, completed checklists, schedules, and system logs). Most of the red flags raised by auditors are related to missing documentation.

Neglecting to Assess Risks

In advance of a compliance audit, a review of risks and gaps should be conducted. This avoids surprises during a compliance audit by providing opportunities to remediate any issues and/or proactively having a plan for remediation in place. 

Poor Audit Oversight

Someone with no conflicts of interest should oversee and/or make decisions related to compliance and compliance audits. This ensures that ongoing oversight and evaluations are made in an unbiased manner and identify all compliance audit risks or gaps.

How a Compliance Audit Is Conducted

A compliance audit is performed to evaluate an organization’s adherence to rules and regulations as well as to assess risks, reporting, and efficacy of policy implementation. To do this, a compliance audit will include reviews of a number of areas, including:

• Communications
• Documentation 
• Employee performance
• Reporting 
• Internal controls
• Security protocols
• Specific areas related to the organization’s industry regulations

The following compliance audit preparation checklist provides guidance that applies to most organizations. These steps will help demonstrate that an organization is ready for the compliance audit and has prepared for auditors’ requests.

• Decide who will perform the audit, if it is internal or assist with it if it is external.
• Address key questions before a compliance audit as part of initial planning, such as:
  • What risks will the compliance audit address?

• What was the outcome of any previous compliance audits?
• Have there been significant changes since the last compliance audit?

• Determine the metrics being used for the compliance audit.   
• Provide a dedicated place for the audit team to work and conduct interviews privately.
• Identify and prepare employees who the auditors will likely interview, and make sure that they are available during the time scheduled for the audit.
• Be prepared to organize a schedule of interviews for the auditors.
• Focus on preparation and an understanding of what will be audited (e.g., standards, regulations, company policies, laws and legal precedents, recognized activities that constitute best practices).  
• Have copies of internal evidence supporting compliance (e.g., reports, emails, policies, procedures, testing reports, previous audit reports, meeting minutes).
• Conduct pre-audit meetings with those likely to be involved in the audit ((e.g., subject matter experts  (SMEs), managers, executives)), make sure that they understand their roles and responsibilities during the audit, and outline compliance checklists, guidelines, and the compliance audit’s scope.
• Evaluate existing processes and controls to assess risks and any gaps.  
• Assess risks to help organizations anticipate potential concerns and opportunities, provide recommendations, or mandates, for remediation as needed.
• Analyze operations and gather the documentation needed to show how the organization’s systems, processes, and people adhere to relevant regulations and rules.

Take Advantage of Compliance Audits

A compliance audit, either internal or external, provides an opportunity for organizations to dig in and identify vulnerabilities that apply not just to the audit, but overall operational and security health.

The process of conducting or being the subject of a compliance audit shines a light on areas that are sometimes overlooked in day-to-day operations. Identifying these weaknesses creates paths for improvement and, often, loosens up funding to support them.   

It is also important to remember that compliance audits are not a one-and-done activity. Sincecompliance rules are in a constant state of flux, being ready for the next compliance audit requires vigilance.

However, compliance audit requirements also provide a guide as to what rules have changed. Staying abreast of compliance audit requirements helps ensure that systems and processes are ready to pass the next audit.

A final opportunity that a compliance audit affords organizations is a leg up on reporting. Reporting is important regardless of a compliance audit. The compliance audit provides a good reason to make sure that reporting and documentation are always up-to-date.

Egnyte has experts ready to answer your questions. For more than a decade, Egnyte has helped more than 16,000 customers with millions of customers worldwide.

Last Updated: 10th May, 2022

Get started with Egnyte.

Request Demo