Law and Regulatory Compliance

Control Objectives for Law and Regulatory Compliance

(a) To ensure that management and staff maintain an accurate awareness of

all relevant legislation and regulations;
(b) To ensure full compliance with the prevailing legislation and regulations;
(c) To ensure that business operations are reviewed and assessed for legal and
regulatory implications;
(d) To ensure that specific responsibility for addressing the relevant
requirements is defined and allocated;
(e) To take the legislative and regulatory requirements into account when
planning change;
(f) To prevent and minimise penalties and litigation arising from non-
compliance; and
(g) To seek reliable professional advice on legal matters in order to select the
optimum solutions.

Risk and Control Issues for Law and Regulatory Compliance

1 Key Issues

1.1 How can management be assured that they are fully aware of all the
relevant legal and regulatory implications for the production facility?
1.2 What measures are in place to ensure that all the relevant legislation
and regulations are correctly complied with?
1.3 Would management be promptly made aware of any failure to
comply or breaches of regulations, and how is this evidenced?
1.4 What mechanisms ensure that all staff are suitably aware of their
responsibilities for legal and regulatory matters?
1.5 Does management take the legal and regulatory implications into
account when either considering or planning changes within the production
environment?
1.6 Does management have access to reliable sources of professional legal
advice when necessary?
1.7 What steps would be taken to minimise the extent of penalties,
litigation cost, and adverse impacts upon the organisation's image and
reputation in the event of a serious breach of regulations?

2 Detailed Issues

2.1 Has the production facility/environment been fully assessed for all the
relevant legal and regulatory implications as the basis for defining the compliance
requirements?
2.2 How does management maintain their awareness of new and changed
legal and regulatory requirements, and how is this evidenced?
2.3 Are any forms of independent inspection undertaken as a means of further
ensuring the necessary compliance?
2.4 Are the relevant regulatory and legal requirements correctly incorporated
into operating procedures and policies (and are they maintained up-to-date)?
2.5 Are measures in place to address the specific regulations for the following
areas?:-
employment;
hours of work;
working conditions;
safety;
facilities;
equipment.
2.6 How is the accuracy of data input from other systems (i.e. the legal
department) confirmed?
2.7 How is the accuracy of data output to other systems (i.e. staff training
records) confirmed?