Compliance audits

Compliance audits comprise a wide range of externally and internally driven exami- nations of an organization’s fulfillment of legal or regulatory requirements, industry standards, licensing terms, contractual commitments, or other formal obligations.

Compliance Audits

Compliance audits overlap conceptually with financial, operational, and certification audits in the sense that those types of audits often address standards, practices, or legal provisions that constitute mandatory requirements for organizations. As a cat- egory, compliance auditing applies more broadly than other types in terms of who performs such audits, the purpose for conducting compliance audits, and the organizational elements or subject areas that provide the scope for audits. Compliance audits driven by needs to demonstrate adherence to legal provisions or regulations (including those conducted as part of formal investigations) are most commonly performed by external auditors. Audits of organizational fulfillment of licensing terms, service level agreements, or other contractual obligations are usually conducted by the legal or contracting functions of one or both parties bound by the contract. Audits that verify compliance with organizationally specified policies, procedures, standards, and guidelines typically fall within the purview of internal auditing programs. The standards and methodologies used in compliance auditing vary according to the context of the audit and the organization or legal entity that has the responsibility to verify compliance. As is the case with many other types of external auditing, the audit criteria used to determine compliance with externally defined requirements are often available to organizations, facilitating their prepara- tion for external audits and enabling organizations to conduct internal self-assess- ments if they choose to do so.

The organizational requirements underlying compliance audits come from many different external sources, in addition to internal policies and governance objectives. Organizations in many industries are subject to both government regulations and commercial standards, each corresponding to different sets of audit criteria. In the United States and many other countries, organizations that operate in regulated industries or that participate in government-sponsored programs must undergo compliance audits. Unlike the securities and financial management laws and regulations that apply to all publicly traded companies and result in all such organizations performing mandatory audits, other types of legal requirements obligate covered organizations to comply but may only formally audit compliance of a small proportion of organizations, selected at random or in response to suspicions, complaints, or prior noncom- pliant behavior. Examples include audits of small businesses, federal grant recipients, and health care providers. Similar approaches to compliance auditing apply to many industry and commercial requirements, including audits of IT and security standards for organizations in financial services, insurance, energy, and retail.

Compliance audits conducted on an ad hoc or one-time basis rather than as a routine or recurring process can sometimes identify serious deficiencies or systemic problems within an organization. For example, for its services acquisition program U.S. Department of Veterans Affairs (VA) has in place small business contracting rules that give prefer- ence to veteran-owned businesses. A 2010 audit by the VA’s Office of Inspector General of the Department’s small business programs found that as many as three-quarters of the small businesses registered with the VA for participation in the program were in fact ineligible, due to what the Inspector General cited as deficient oversight and verification

Compliance audits