A policy proves that someone wrote a policy. It does not prove that access was reviewed, gifts were approved, deletion happened, or a complaint reached the board. An audit connects each applicable obligation to a control, a population, a test, and retained evidence.
Freeze the obligation universe
Start with entities, jurisdictions, licences, products, customer types, workforce locations, data categories, payment flows, and contractual promises. Convert applicable statutes, regulator conditions, permits, orders, and binding contracts into individual requirements. Record why each requirement applies and the effective version used.
Define exclusions with equal care. A control register copied from a public-company template can bury the risks of a ten-person startup under irrelevant attestations. Scope decisions need an owner, legal rationale, date, and trigger for reconsideration, such as entering a new country or launching a regulated feature.
Test operation through populations and samples
For every control, identify the full population and the system that produced it. A sample of five approved vendors means little if no one can produce the complete vendor list. Preserve the query, period, selection method, evidence requested, exceptions, and reperformance result so another reviewer can repeat the test.
Interview answers are leads, not closure. Corroborate them with access logs, approvals, tickets, training records, due-diligence files, hotline cases, invoices, deletion logs, or board materials. DOJ's guidance asks whether a program works in practice; that question cannot be answered from policy language alone.
- Governance5 count
- Third parties4 count
- Data controls6 count
- Reporting3 count
DOJ Evaluation of Corporate Compliance Programs (2026-08). Worked audit: evidence items tested in four control lanes; not a maturity score or industry benchmark.
Write findings that can be acted on
A finding should state the requirement, expected control, condition observed, evidence, affected population, period, cause, consequence, and owner response. Separate legal exposure from operational severity and likelihood; counsel may need to preserve privilege over legal analysis while the factual remediation record remains usable.
Do not convert every exception into a dramatic violation. A missing timestamp, a failed control, and an established breach are different conclusions with different evidence burdens. State uncertainty, identify missing evidence, and route suspected misconduct or reportable incidents through counsel and the applicable response procedure.
Close only after verified remediation
Worked example: an audit finds quarterly access reviews were signed but excluded contractor accounts. Management first corrects the population query, removes unjustified access, reruns the review, and retains evidence. A reviewer who did not perform the fix then tests the new population and marks the issue verified; a promise to fix is not closure.
This method was reviewed on 21 August 2026 and is not legal advice, an assurance opinion, or a certification against DOJ, NIST, ICO, or any standard. Applicability, privilege, regulator reporting, sampling, retention, and auditor independence differ by jurisdiction and engagement. Agree those limits with qualified counsel and the audit sponsor before fieldwork.
Frequently asked questions
Is a compliance checklist an audit?
No. An audit needs defined criteria, scope, populations, tests, evidence, findings, and review.
Can the control owner test their own control?
They can monitor it, but independent verification gives stronger assurance and should close material findings.
How should missing evidence be treated?
As a limitation or exception, not automatic proof that the underlying act never occurred. Investigate and state the boundary.
Should legal counsel run every audit?
Not necessarily. Counsel should advise on applicability, privilege, investigations, reporting, and legal conclusions; competent auditors can test controls.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in A Compliance Audit Tests Evidence, Not Confidence is attributed. Where a number is an estimate rather than a census, the note says so.
- DOJ Evaluation of Corporate Compliance ProgramsOfficial prosecutorial guidance on design, implementation, and effectiveness.
- DOJ and SEC FCPA Resource GuideOfficial anti-corruption compliance and enforcement guidance.
- NIST Cybersecurity Framework 2.0Official risk-governance functions and outcomes; not a legal certification.
- ICO Accountability FrameworkRegulator framework for evidence of data-protection accountability.
Primary sources used for this edition.
The bottom line
The audit trail should let a new reviewer reproduce the test and understand exactly why the issue closed.
If you want the adjacent decisions after A Compliance Audit Tests Evidence, Not Confidence, start with Industry compliance, International legal, Contract controls, Insurance controls.
