Legal and Regulatory Compliance in Governance of Enterprise IT (CGEIT)
Legal and Regulatory Compliance: A Complete CGEIT Guide
1. Introduction
Legal and Regulatory Compliance is a core theme in the CGEIT domain Governance of Enterprise IT. CGEIT (Certified in the Governance of Enterprise IT) is ISACA's certification for people who direct, oversee and assure IT governance. In this setting, compliance is not about technical controls or checklists. It is about how the board and executive management make sure the enterprise and its use of IT meet external obligations. These obligations include laws, regulations, contracts and industry standards. A good compliance programme also protects stakeholder value and keeps risk within appetite.
2. Why Legal and Regulatory Compliance Is Important
Accountability rests with the board. Directors and executives are legally accountable for compliance failures. This applies even when IT operations are outsourced or delegated. Regulators increasingly name individuals personally, for example under GDPR, SOX, DORA and NIS2.
Financial and reputational exposure. Non-compliance can bring fines, sanctions, litigation, loss of licences and lasting reputational damage. For example, GDPR fines can reach 4% of global annual turnover.
Value delivery and trust. Compliance is part of meeting stakeholder needs, which is the first COBIT principle. Customers, investors and partners expect personal data, financial data and critical services to be protected.
Business enablement. Proven compliance can open markets. Examples include PCI DSS certification, ISO 27001, SOC 2 reports and public-sector accreditation.
Risk optimisation. Compliance risk is one category of enterprise risk. Governance must balance the cost of compliance against the cost of non-compliance and stay within risk appetite.
Regulatory dynamics. Laws change quickly. New areas include AI regulation, cross-border data transfer, cybersecurity disclosure rules and ESG reporting. Without a governance mechanism to track changes, enterprises fall behind.
3. What Legal and Regulatory Compliance Is
Compliance means following external requirements and internal policies that apply to the enterprise. In COBIT 2019 it is covered mainly by two objectives:
- MEA03: Managed Compliance With External Requirements. This covers identifying legal, regulatory and contractual requirements, keeping track of them, confirming compliance and getting assurance.
- EDM01: Ensured Governance Framework Setting and Maintenance. The governance system must take legal and regulatory requirements into account.
Related objectives include:
- APO01 (Managed I&T Management Framework)
- APO12 (Managed Risk)
- APO13 (Managed Security)
- APO10 (Managed Vendors)
- APO14 (Managed Data)
- MEA02 (Managed System of Internal Control)
- MEA04 (Managed Assurance)
Types of requirements:
- Laws and statutes: data protection (GDPR, CCPA, HIPAA, LGPD), financial reporting (SOX, J-SOX), cybercrime laws, e-commerce laws, intellectual property and software licensing, employment law, records retention.
- Regulations and supervisory rules: banking (Basel, DORA, FFIEC, MAS TRM), healthcare, telecom, critical infrastructure (NIS2).
- Contractual obligations: SLAs, outsourcing and cloud contracts, licence agreements, PCI DSS (imposed by contract through card brands).
- Industry standards and voluntary codes: ISO/IEC 27001, ISO 22301, SOC reporting. These become mandatory if contracts or regulators require them.
- Internal policies: board-approved policies that put external obligations into effect and reflect the organisation's risk appetite.
Key concepts:
- Compliance vs. conformance: Compliance means meeting mandatory external requirements. Conformance means following voluntary standards or internal policies.
- Due care and due diligence: Due care is doing what a reasonable, prudent person would do. Due diligence is investigating and verifying that controls really work.
- Jurisdiction and data sovereignty: data stored or processed across borders may fall under several, sometimes conflicting, legal regimes.
- Compliance risk: the risk of legal sanctions, financial loss or reputational harm from failing to comply.
4. How Legal and Regulatory Compliance Works (The Governance Lifecycle)
Step 1: Identify requirements. Legal, compliance and IT teams scan the environment continuously to find applicable laws, regulations and contractual obligations in every jurisdiction where the enterprise operates or processes data. The output is a compliance register or obligations inventory.
Step 2: Assess impact and risk. Analyse how each requirement affects business processes, information and IT systems. Do a gap analysis. Rate compliance risk using the enterprise risk management framework.
Step 3: Direct through policy. The board and executives set the tone at the top. They approve policies and assign ownership and accountability, for example through a RACI matrix. Common roles include a compliance officer, a data protection officer, a CISO and business process owners.
Step 4: Implement controls. Management turns policies into standards, procedures and controls, both technical and administrative. Controls are mapped to requirements so one control can satisfy many regulations. This approach is called integrated compliance or a common control framework.
Step 5: Communicate and train. Staff, contractors and third parties must understand their obligations through awareness programmes and contract clauses.
Step 6: Monitor and confirm. Use compliance metrics, KPIs and KRIs. Include self-assessments, internal audit and continuous monitoring. Get independent assurance through external audit, regulatory examination and certifications.
Step 7: Report and remediate. Report compliance status to the board or audit committee. Track corrective actions to closure. Notify regulators of breaches within required timelines, for example the 72-hour GDPR breach notification.
Step 8: Maintain and improve. Update the register as laws change. Review the effectiveness of the compliance programme and take in lessons learned.
Third parties and cloud: Accountability for compliance cannot be outsourced. Governance must make sure that:
- contracts include compliance obligations, right-to-audit clauses and data location requirements;
- vendors provide assurance reports such as SOC 2 or ISO certificates;
- vendor risk is monitored over the whole relationship.
Roles summary:
- Board/governing body: evaluates, directs and monitors. It sets risk appetite and holds management accountable.
- Executive management: implements the compliance programme and provides resources.
- Legal/compliance function: interprets requirements and advises.
- Business process owners: own compliance within their processes.
- IT: implements and operates supporting controls.
- Internal audit: provides independent assurance and should not own compliance controls.
5. Common Scenarios in CGEIT Questions
- A new regulation is announced. What should IT governance do first?
- The enterprise moves data to a cloud provider in another country. What is the primary concern?
- Audit finds unlicensed software. Who is accountable, and what is the best governance response?
- Several overlapping regulations apply. What is the most efficient approach?
- The board wants assurance that IT complies with laws. What provides the best evidence?
6. Exam Tips: Answering Questions on Legal and Regulatory Compliance
Tip 1: Think like a governance executive, not a technician. CGEIT rewards answers about direction, accountability, policy, oversight and alignment. Avoid answers about configuring firewalls or running scans unless nothing else fits.
Tip 2: Identify requirements before acting. When a new law or market entry is involved, the first step is usually to identify and understand the applicable requirements, or to perform an impact or gap analysis. Buying tools or implementing controls comes later.
Tip 3: Accountability cannot be delegated or outsourced. The enterprise and ultimately the board stay accountable even when a vendor processes the data. Pick answers that keep oversight in place, such as contract clauses, right to audit and assurance reports.
Tip 4: Prefer integrated, enterprise-wide approaches. When several regulations overlap, the best answer is usually a common or integrated control framework mapped to all requirements. Avoid separate projects for each regulation.
Tip 5: Business ownership is key. Compliance belongs to the business, not just IT. Answers that assign ownership to business process owners, with IT supporting, are usually stronger.
Tip 6: Watch qualifier words. FIRST, PRIMARY, BEST, MOST and GREATEST matter. For example:
- PRIMARY reason for compliance: usually avoiding legal or regulatory risk while supporting stakeholder value.
- BEST evidence: independent assurance, such as external or internal audit, rather than management self-assertion.
Tip 7: Link compliance to risk management. Compliance risk should be assessed and reported within the enterprise risk framework and risk appetite. Answers that integrate compliance with ERM usually beat isolated answers.
Tip 8: Policy comes before procedures. In the governance hierarchy, the board approves policies first. Standards, procedures and controls follow. If no policy exists, establishing one is often the correct answer.
Tip 9: Remember COBIT mapping. MEA03 covers compliance with external requirements. MEA02 covers internal controls. EDM objectives cover governance direction. Knowing which objective applies helps you eliminate wrong options.
Tip 10: Cost-benefit, but legal requirements are non-negotiable. Most risks can be accepted within appetite. Mandatory legal requirements generally cannot simply be accepted. Be careful with answers that suggest accepting non-compliance with the law.
Tip 11: Cross-border data issues. For questions on data location, cloud or outsourcing abroad, the primary concern is usually the legal and regulatory requirements of the jurisdictions involved, including data privacy and sovereignty.
Tip 12: Reporting to the board. The board needs concise, risk-based compliance status reports, such as dashboards and trend metrics. Detailed technical logs are not appropriate. Choose answers that give the board what it needs to make decisions.
Tip 13: Eliminate extreme or reactive answers. Options like stopping all operations, firing staff or waiting for the regulator to act are rarely correct. Prefer proactive, structured and sustainable answers.
Tip 14: Continuous monitoring beats one-time effort. Compliance is an ongoing cycle. Answers that set up continuous monitoring and periodic review are usually better than one-off projects.
7. Sample Question Walkthrough
Question: An enterprise plans to expand operations into a new country with strict data protection laws. What should the IT steering committee do FIRST?
A. Implement encryption on all databases
B. Identify the legal and regulatory requirements of the new jurisdiction and assess their impact
C. Appoint an external auditor
D. Update the incident response plan
Answer: B. You cannot design controls (A, D) or get assurance (C) until you know what the requirements are and how they affect the enterprise. This follows the identify, assess, direct, implement, monitor sequence.
8. Key Takeaways
- Compliance is a governance responsibility. The board is accountable and sets direction through policy and risk appetite.
- Follow the lifecycle: identify, assess, direct, implement, communicate, monitor, report and improve.
- Use integrated control frameworks to handle overlapping regulations efficiently.
- Accountability stays with the enterprise when using third parties and cloud services.
- Independent assurance provides the best evidence of compliance.
- In the exam, choose answers that are strategic, proactive, business-aligned and risk-based.
