Laws and Regulations Applicable to the Auditee: A Complete ISO 27001 Lead Auditor Guide
Introduction
One of the fundamental audit concepts every ISO/IEC 27001 Lead Auditor must master is how laws, regulations and other legal requirements apply to the auditee. An Information Security Management System (ISMS) never operates in a vacuum. Every organization is subject to a web of legal, statutory, regulatory and contractual obligations, and many of them relate directly to information security, privacy and data protection. This guide explains why the topic matters, what it covers, how it works in practice during an audit, and how to answer exam questions about it with confidence.
Why Laws and Regulations Applicable to the Auditee Are Important
Understanding the legal context of the auditee is critical for several reasons:
1. ISO/IEC 27001 explicitly requires it. Clause 4.2 requires the organization to determine the needs and expectations of interested parties, including legal and regulatory requirements. Clause 4.1 requires it to understand its internal and external context. Annex A control 5.31 (Legal, statutory, regulatory and contractual requirements) requires these requirements to be identified, documented and kept up to date. Related controls include 5.32 (Intellectual property rights), 5.33 (Protection of records), 5.34 (Privacy and protection of PII) and 5.36 (Compliance with policies, rules and standards).
2. Compliance is one of the core purposes of an ISMS. A key intended outcome of an ISMS is to ensure that the organization meets its obligations. An ISMS that ignores legal requirements cannot be considered effective.
3. Audit risk and credibility. If an auditor fails to consider the legal framework, the audit may miss significant nonconformities. That affects the reliability of the audit conclusions and the reputation of the certification body.
4. ISO 19011 and ISO/IEC 17021-1 alignment. ISO 19011:2018 includes knowledge of laws and regulations among the generic competences auditors need. Auditors should understand the legal requirements applicable to the auditee, at least to the extent needed to audit effectively, and should know the laws affecting their own work, such as confidentiality obligations.
5. Protection of the auditor and the audit program. Auditors must handle sensitive information lawfully, respect confidentiality, and avoid actions such as accessing personal data without proper authorization. Laws apply to the conduct of the audit itself, not only to the auditee.
What It Is
Laws and regulations applicable to the auditee are all the legal and regulatory obligations the organization must meet within the scope of its ISMS. They typically include:
Data protection and privacy laws: for example the GDPR in the EU, CCPA/CPRA in California, PIPEDA in Canada and LGPD in Brazil.
Sector-specific regulations: for example HIPAA for US healthcare, PCI DSS for payment card data, DORA and NIS2 in the EU, and SOX for financial reporting controls.
Cybercrime and computer misuse laws: for example the UK Computer Misuse Act.
Intellectual property laws: copyright, software licensing, trademarks and patents.
Records retention laws: tax, employment, accounting and healthcare record retention requirements.
Electronic communications and e-signature laws: for example eIDAS in the EU.
Cryptography and export control regulations: restrictions on importing, exporting or using encryption technologies.
Employment law: employee monitoring, background screening and disciplinary processes.
Contractual obligations: service level agreements, non-disclosure agreements and customer security requirements. These are not laws, but ISO 27001 treats them alongside legal requirements.
Key distinction: ISO 27001 itself is a voluntary standard, not a law. It does, however, require the organization to identify and comply with the laws and regulations relevant to it. The auditor does not judge legal compliance like a lawyer or regulator would. Instead, the auditor assesses whether the ISMS has an effective process to identify, evaluate and meet these obligations.
How It Works in Practice
1. Before the audit (preparation stage)
The audit team leader and team members should:
- Review the auditee's context, industry, geographic locations and scope.
- Identify the main legal and regulatory frameworks likely to apply, such as GDPR for an EU organization handling personal data.
- Make sure the audit team has competence in those areas, or bring in a technical expert if needed. Under ISO 19011, the audit team's competence should cover the legal requirements relevant to the auditee.
- Consider the laws that govern the audit itself, such as data privacy restrictions on reviewing records or cross-border data transfers of audit evidence.
2. During Stage 1 (documentation review)
The auditor checks whether:
- The organization has a documented register or list of applicable legal, regulatory and contractual requirements.
- That register is linked to the context analysis (Clause 4.1), interested parties (Clause 4.2) and risk assessment (Clause 6.1.2).
- Requirements are reflected in the Statement of Applicability, policies and controls.
3. During Stage 2 (implementation and effectiveness)
The auditor gathers objective evidence that:
- Responsibilities for monitoring legal changes are assigned.
- The register is reviewed and updated, for example after new legislation is enacted.
- Controls meeting legal requirements are actually implemented, such as data breach notification procedures under GDPR (72 hours to notify the supervisory authority).
- Compliance is evaluated, through internal audits, compliance reviews and management review inputs.
- Nonconformities related to legal obligations are handled through corrective action.
4. Handling suspected illegal activity or legal noncompliance
If the auditor finds evidence of noncompliance with legal requirements:
- The auditor records it as an audit finding, usually a nonconformity against Clause 4.2, Clause 6.1 or control 5.31, based on objective evidence.
- The auditor does not act as a legal enforcer and does not give legal advice.
- Under ISO/IEC 17021-1, a significant legal noncompliance may affect certification decisions. Certification bodies often treat such findings seriously, as they may show that the ISMS is not achieving its intended outcomes.
- If there is a risk to safety or a legal obligation to report, the audit team leader should inform the client and the audit program manager, and follow any legal reporting duties.
- Confidentiality must be maintained unless disclosure is required by law.
5. Laws applicable to the auditor
Auditors must also consider:
- Confidentiality and non-disclosure obligations.
- Data protection when handling personal data seen during the audit.
- Restrictions on taking photographs, copying records or removing documents.
- Legal limits on access to certain areas or information, such as classified government data.
Relationship to Audit Principles (ISO 19011)
This topic connects to several audit principles:
- Integrity: acting honestly and responsibly, and being aware of applicable legal requirements.
- Fair presentation: truthfully reporting findings, including legal noncompliance.
- Due professional care: applying competence, including legal awareness.
- Confidentiality: protecting information lawfully.
- Independence: not becoming the auditee's legal consultant.
- Evidence-based approach: basing findings on verifiable evidence, not assumptions about legal status.
- Risk-based approach: focusing on areas where legal risk is significant.
Common Audit Scenarios
Scenario 1: A healthcare company has no register of legal requirements but claims its legal department handles compliance. Auditor action: Request evidence of how requirements are identified and maintained. If there is no documented identification, raise a nonconformity against control 5.31, and possibly Clause 4.2.
Scenario 2: An organization stores EU customer personal data in a third country without assessing transfer mechanisms. Auditor action: Record a finding related to control 5.34 and Clause 6.1. Avoid issuing a legal opinion on whether the transfer violates GDPR. Focus on whether the ISMS addressed the requirement.
Scenario 3: The auditor discovers unlicensed software. Auditor action: Raise a nonconformity against control 5.32 (Intellectual property rights), supported by objective evidence.
Scenario 4: The auditee asks the auditor which laws they should comply with. Auditor action: Politely decline to give consulting advice, since doing so would compromise independence. The auditor may point out that identifying applicable requirements is the organization's responsibility.
Exam Tips: Answering Questions on Laws and Regulations Applicable to the Auditee
Tip 1: Remember the auditor's role is not that of a lawyer. Exam questions often test whether you understand that auditors verify whether the ISMS identifies and addresses legal requirements. They do not interpret laws or provide legal advice. Be cautious with answer options such as 'the auditor should advise the auditee on the correct law'. They are usually wrong.
Tip 2: Know the key clauses and controls. Memorize Clause 4.1 (context), Clause 4.2 (interested parties and their requirements, including legal ones), Clause 6.1 (risks and opportunities) and Annex A controls 5.31 to 5.36. Many scenario questions ask which clause or control a finding relates to.
Tip 3: Distinguish ISO 27001 from legal compliance certification. ISO 27001 certification does not certify that an organization is legally compliant. It certifies that the ISMS conforms to the standard, including having processes to address legal requirements. Options claiming certification guarantees GDPR compliance are incorrect.
Tip 4: Always base findings on objective evidence. In scenario questions, choose answers where the auditor gathers evidence, such as records, interviews or observations. Avoid answers where the auditor assumes or speculates about legal violations.
Tip 5: Apply the confidentiality principle carefully. If asked what an auditor should do upon discovering illegal activity, the best answer usually involves documenting the finding, informing the audit team leader or client management, and following legal reporting duties if they exist. Do not choose answers involving immediate public disclosure or contacting the media.
Tip 6: Consider competence in audit team selection. Questions may ask how to ensure the audit team can assess legal aspects. The correct answer typically involves selecting auditors with relevant knowledge or adding a technical expert, as ISO 19011 recommends.
Tip 7: Remember contractual requirements count too. ISO 27001 groups legal, statutory, regulatory and contractual requirements together. If a question involves a customer contract specifying security measures, treat it as a requirement the ISMS must address.
Tip 8: Watch for jurisdiction and scope. Requirements depend on where the organization operates, where its customers are, and what data it processes. In scenario questions, look for clues like 'operates in the EU' or 'processes payment cards' to identify the relevant frameworks.
Tip 9: Link legal requirements to the risk assessment. Strong answers show how legal requirements feed into the risk assessment and treatment process, and into the Statement of Applicability. Legal requirements can also justify including controls that might otherwise be excluded.
Tip 10: Use structured answers for essay-style questions. For written exam answers, such as those in the PECB Lead Auditor exam, follow this structure:
1. Identify the requirement (clause or control).
2. Describe the evidence observed.
3. State whether it is a conformity or a nonconformity, and classify it as major or minor if asked.
4. Justify your conclusion by referring to the standard.
Example: 'The organization processes personal data of EU residents but has not identified the GDPR as an applicable requirement in its register of legal obligations. This is a nonconformity against ISO/IEC 27001 control 5.31 and Clause 4.2, as the organization has not determined the relevant legal requirements of interested parties.'
Tip 11: Major versus minor classification. A complete absence of a process to identify legal requirements, or a systemic failure, tends to be a major nonconformity. An isolated omission, such as one outdated regulation in an otherwise maintained register, tends to be minor. Justify your classification based on the impact on the ISMS's ability to achieve its intended outcomes.
Tip 12: Know what auditors should do about laws affecting the audit. Questions may ask about data protection during an audit. Remember that auditors must handle personal data lawfully, obtain authorization before accessing sensitive records, and protect audit documentation.
Summary
Laws and regulations applicable to the auditee form a cornerstone of an effective ISMS and a credible audit. The organization is responsible for identifying, documenting, implementing and monitoring its legal, statutory, regulatory and contractual obligations. The auditor's job is to verify, through objective evidence, that this process exists and works, while remaining independent, maintaining confidentiality and avoiding legal advice. In the exam, anchor your answers in the relevant clauses (4.1, 4.2, 6.1) and controls (5.31 to 5.36), apply the ISO 19011 audit principles, and always justify conclusions with evidence and references to the standard.
