compliance audit

What is a compliance audit?

A compliance audit is a comprehensive review of an organization's adherence to regulatory guidelines. Audit reports evaluate the strength and thoroughness of compliance preparations, security policies, user access controls and risk management procedures over the course of a compliance audit.

What precisely is examined in a compliance audit varies depending on whether an organization is a public or private company, what types of data it handles, and whether it transmits or stores sensitive financial data.

Examples of compliance audits

• A Sarbanes-Oxley Act compliance audit would have to prove that any electronic communication is backed up and secured with a reasonable disaster recovery infrastructure.
• Healthcare providers that store or transmit e-health records, including personal health information, are subject to HIPAA, or Health Insurance Portability and Accountability Act, laws and regulations.
• Financial services companies that transmit credit card data are subject to Payment Card Industry Data Security Standard requirements.

In each case, organizations must demonstrate compliance by producing an audit trail, often generated with data from event log management software as well as internal and external audits.

Internal compliance audits vs. external compliance audits

Internal compliance audits are conducted by employees of a company to gauge overall risks to compliance and security as well as to determine whether the company is following internal guidelines. Internal audits occur throughout the fiscal year, and management teams use reports to identify areas that require improvement. Internal audits measure company objectives against output and strategic risks.

External compliance audits are formal audits conducted by independent third parties. They follow a specific format determined by the compliance regulation being assessed. External audit reports measure if an organization is complying with state, federal or corporate regulations, rules and standards.

An auditor's report is used by regulators to assess possible fines for noncompliance or by the C-suite to prove regulatory compliance. An external compliance auditor might use internal audits to further evaluate compliance and regulatory risk management efforts.

Overview of an external compliance audit

External compliance audits begin with a meeting between company representatives and compliance auditors to outline compliance checklists, guidelines and the scope of the audit.

The auditor conducts reviews of employee performance, studies internal controls, assesses documents and checks for compliance in individual departments.

Compliance auditors will generally ask members of the C-suite and IT administrators a series of specific questions that might include what users were added and when, who has left the company, whether user IDs have been revoked, and which IT administrators have access to critical systems.

IT administrators can prepare for compliance audits using event log managers and robust change management software to track and document authentication and controls in their IT systems. The growing category of governance, risk and compliance software can help CIOs quickly show auditors that an organization is compliant as well as avoid costly fines or sanctions.

Auditors then review business compliance processes as a whole and create a final audit report. Compliance auditors provide details to company leaders about the organization's level of compliance adherence, any violations and suggestions for improvement. They eventually make the audit report public.

Importance of compliance auditing

Compliance auditing, whether internal or external, can help a company identify weaknesses in regulatory compliance processes and create paths for improvement. In some cases, guidance provided by a compliance audit can reduce risk and mitigate potential legal trouble or federal fines for noncompliance.

Much like the laws that drive them, compliance programs are in a constant state of flux as existing regulations evolve and new ones are implemented. Compliance auditing provides an outline of internal business processes that can be changed or improved as regulations and requirements change.