1What is a compliance audit?
Unlike scenario-based risk-analysis methods, acompliance audit assesses the current situation against predefined requirements: every clause or requirement in a framework (ISO standard, regulation, or industry standard) is reviewed and rated as compliant, partially compliant, non-compliant, or not applicable.
It covers many fields, from cybersecurity (ISO 27001, NIS2, ANSSI frameworks) to industry (SEVESO safety-management systems, ICPE, ATEX), using one common methodology.
Do not confuse two metrics:avancement measures the share of requirements already processed (a requirement marked not applicable counts as processed), while compliance measures compliant requirements as a share of those that actually apply.
2Method steps
- Select the framework or frameworks applicable to the organisation (standard, regulation, or framework).
- Form the audit team — distinguish auditeurs (who validate) from auditees (who document the actual situation).
- Assess every requirement — compliance status, evidence, and identified gaps—or mark it not applicable when outside the scope.
- Faire valider par l'auditeur each assessment separately from the auditee's input.
- Soumettre le dossier — the Submitted status freezes auditee input during review.
- Consolider le plan d'actions for identified gaps, with owners and deadlines.
- Generate the audit report and monitor the compliance rate over time.
A requirement marked Not applicable must always include an explicit justification; otherwise reviewers cannot distinguish a deliberate scope decision from an omission.
3Example completed in Polyodos
Section to be completed — step-by-step ISO 27001 audit of an information-system scope, with Polyodos screenshots from requirement assessment to the compliance report.
4Common mistakes
| Mistake | Why it is a problem |
|---|---|
| Confusing completion and compliance | A file can be 100% complete but only 40% compliant. Presenting one as the other creates a false impression of control. |
| Letting auditees validate their own assessment | Auditor and auditee roles are separated specifically to prevent self-assessment without independent review. Bypassing this separation defeats the purpose of the audit. |
| Edit a “submitted” file | Submitted status deliberately freezes auditee input during review. Reopening it outside the defined cycle breaks the audit trail of what was actually reviewed. |
| Overusing Not applicable | Excluding too many requirements as not applicable artificially inflates the compliance rate. Every exclusion must be defensible to a third party. |