Many US teams struggle with the same problem: they know they need an audit but not which one. A HIPAA review, a SOC 2 examination, and an OSHA inspection all carry the "audit" label, yet they differ in who performs them and what the result is worth.
This article defines compliance audits, walks through the major types, separates internal, external, and regulatory audits, and shows how to pick the right one.
Key Takeaways
- A compliance audit measures an organization against defined laws, standards, contracts, or internal policies.
- Audits group by subject (cybersecurity, privacy, finance, healthcare, environment, safety) and by who performs them.
- Readiness reviews, attestations, certifications, and regulatory exams produce different kinds of assurance.
- Choose based on obligations, risk, evidence, resources, and how you'll use the result.
- Treat findings as a remediation backlog, not a one-time event.
What Is a Compliance Audit?
A compliance audit is a structured, impartial review of an organization's controls, records, and practices against defined requirements. NIST describes a security control assessment as testing whether controls are implemented correctly, operate as intended, and meet system requirements.
Auditors typically review policies, contracts, system configurations, access records, training evidence, and transaction records. They also interview staff and observe workflows before issuing findings.
How It Differs From Related Activities
- Readiness or gap assessment: finds weaknesses before the formal audit. It doesn't produce certification or independent attestation.
- Penetration test: mimics real attacks to find exploitable weaknesses. An audit asks whether required controls are designed, implemented, and evidenced.
Depending on the framework, the audit deliverable may be a report, opinion, certification, or Report on Compliance.
Audits are triggered by many forces: law, customer contracts, cyber insurance underwriting, a certification goal, an acquisition, or management's own need for assurance.
Why Are Compliance Audits Important?
Audits surface control gaps early, give customers and regulators stronger evidence, and help prioritize security spending. Without them, organizations drift into:
- Outdated policies
- Undocumented controls
- Weak access management
- Repeat findings
DeepSeas sees one pattern often: organizations fail or delay a first assessment not because controls are missing, but because evidence is scattered across people, tools, and inboxes.
The Cost of Getting It Wrong
Exposure is legal, financial, contractual, and reputational. Current published maximums show the range:
| Authority | Verified amount |
|---|---|
| HIPAA (per violation, highest tier) | $73,011 to $2,190,294 |
| CCPA/CPPA | Up to $2,663 per violation; $7,988 if intentional or involving minors |
| Federal OSHA (2026) | $16,550 per serious violation; $165,514 willful or repeated |
| EPA Clean Air Act | $124,426 statutory civil maximum |
These are per-violation regulatory ceilings, not annual caps or typical settlements. In August 2025, OCR settled with BST & Co. CPAs for $175,000 after finding inadequate ePHI risk analysis, with two years of monitored corrective action.
A Finding Isn't Automatic Failure
Severity, duration, scope, compensating controls, and remediation plans all shape how a finding reads. Minor nonconformities are isolated, but several minor ones can reveal a systemic problem and escalate to major.
PCI also allows documented compensating controls when a requirement can't be met as stated. Recurring reviews and remediation tracking turn the audit into continuous improvement instead of an annual scramble.
Types of Compliance Audits
There are two lenses. You can group audits by the area being evaluated, or by who performs them and the assurance they give.
One organization often faces several at once. A hospital system might see a HIPAA review, a cybersecurity audit, and a financial controls audit in the same year.
Cybersecurity and IT Compliance Audits
These review information systems, security governance, and technical safeguards. Common reference points:
- NIST Cybersecurity Framework 2.0 (released February 2024)
- ISO/IEC 27001:2022
- SOC 2 Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy
- PCI DSS v4.0.1 for cardholder data
Testing often covers identity and access, vulnerability management, logging, incident response, encryption, backup and recovery, change management, cloud, and third-party access.
Best for: technology firms, service providers, regulated organizations, and anyone needing evidence of security controls. Strength: ties technical controls to business risk. Trade-off: needs accurate system inventories, technical evidence, and specialized expertise.
Data Privacy and Protection Audits
These evaluate how an organization collects, uses, stores, shares, retains, and deletes personal data. US reference points include the HIPAA Privacy Rule, CCPA/CPRA, and other state laws. The IAPP counts 23 enacted comprehensive state privacy laws as of July 2026.
California's regulations, effective January 1, 2026, add cybersecurity audits for businesses meeting specified significant-risk criteria. First certifications are due April 1 of 2028, 2029, or 2030, depending on revenue.
Audits examine data inventories, notices, consent, consumer requests, retention, breach response, and vendor agreements. Best for: anyone handling customer, employee, patient, or financial data. The hard part is scoping when data crosses departments, clouds, vendors, and states.
Financial Reporting and Internal Controls Audits
These review the controls behind accurate, complete, authorized financial reporting. This isn't a general financial statement audit.
- SOX: Section 302 requires executive certification of internal controls. Section 404 adds auditor attestation, though non-accelerated filers are exempt from that attestation.
- SOC 1: examines service-organization controls relevant to customers' internal control over financial reporting.
- Transaction and acquisition-related control reviews.
Auditors test approvals, reconciliations, segregation of duties, access to financial systems, and management review. Best for: public companies, financial institutions, service providers, and deal-bound firms. Expect heavy sampling and coordination across finance, IT, legal, and operations.
Healthcare and Other Sector-Specific Audits
These apply because of your industry, funding, customers, or regulated activity.
- HIPAA Security Rule: protects ePHI through administrative, physical, and technical safeguards. OCR's 2024-2025 program audited 50 covered entities and business associates, focused on hacking and ransomware provisions.
- Breach Notification Rule: governs notice after breaches of unsecured PHI.
- Medicare and Medicaid: CMS runs program audits of Medicare Advantage and Part D plans. Medicaid managed care rules require independent audits of encounter and financial data at least every three years.
- Defense and federal cloud: CMMC and NIST SP 800-171 for defense contractors (CMMC Phase 1 implementation is currently paused); FedRAMP for federal cloud
- Education and financial services: FERPA and GLBA for higher education; FFIEC expectations for financial institutions
Higher education shows how this plays out. Federal Student Aid has flagged rising GLBA non-compliance findings from annual audits and demanded corrective action plans within 30 days.
Best for: organizations whose eligibility to operate depends on sector rules. The trade-off: obligations vary by state, contract, regulator, and activity.
Environmental, Social, and Workplace Safety Audits
Separate legal requirements from voluntary frameworks here.
- Legally required: EPA permits and statutes (emissions, waste, hazardous materials) and OSHA rules. Many employers with more than 10 employees must keep injury and illness records, report fatalities within 8 hours, and report specified severe injuries within 24 hours.
- Voluntary: ISO 14001 (environmental management), ISO 45001 (occupational health and safety), and GRI sustainability reporting.
The SEC's 2024 climate disclosure rules were stayed, and rescission was proposed in May 2026, so don't treat them as settled obligations.
Best for: manufacturers, construction firms, laboratories, and logistics providers. These audits improve operational discipline but require site inspections and physical evidence.
Internal, External, and Regulatory Audits
Who performs the work shapes the assurance you can show customers, boards, and regulators.
- Internal: run by employees or an internal audit team to find gaps and improve controls. Useful, but not equal to independent assurance.
- External: performed by an independent party for customers, regulators, investors, or certification.
- Regulatory: conducted by government agencies, with possible enforcement consequences.
A consultant-led readiness review isn't automatically a certification or attestation. Auditor qualifications are framework-specific:
- SOC reports come from licensed, independent CPAs.
- PCI assessments use Qualified Security Assessors.
- ISO 27001 certification comes from certification bodies working to ISO/IEC 27006-1:2024.
How to Choose the Right Type of Compliance Audit
Pick based on obligations, risk, goals, and intended use of the results, not the most famous framework. Work through these factors:
- Purpose: Is it legally required, customer-requested, for certification, insurance, post-incident, or internal improvement?
- Scope and risk: Which data, systems, locations, vendors, and processes carry the most exposure?
- Framework and evidence: Map to the exact requirements, then confirm you can produce policies, logs, approvals, and test results.
- Resources: Do you have process owners, technical specialists, and budget? Internal review fits early, low-stakes checks. Independent expertise fits anything others will rely on.
- Deliverable: Do you need an internal report, a readiness assessment, a certification, or a formal attestation to share?
- Scale: Will it support new frameworks, acquisitions, cloud adoption, or new products?
The type matters because deliverables differ. A SOC 2 Type I report covers control design at a point in time; Type II adds operating-effectiveness testing.
When Outside Help Makes Sense
Teams without enough internal GRC capacity can use a practitioner-led provider. DeepSeas helps scope engagements, map controls, find readiness gaps, organize remediation, and prepare for frameworks such as SOC 2, ISO 27001, and HIPAA.
DeepSeas specialists include ISO Lead Auditor-certified personnel, though the final certificate still comes from an accredited certification body or licensed CPA firm, depending on the framework.
What to Check Before Finalizing an Audit Type
Don't choose an audit because it's familiar or one stakeholder asked for it. Confirm the exact requirement and what the result will be used for.
Watch for:
- Overlapping frameworks and duplicated evidence requests
- Unclear ownership and outdated policies
- Missing system inventories or thin audit trails
- A reviewer who can't provide recognized assurance
Before kickoff, confirm:
- Scope and criteria
- Sampling period and deliverables
- Auditor qualifications
- Confidentiality terms
- Remediation process and timeline
Conclusion
Compliance audits are structured tools for checking whether controls and practices meet legal, regulatory, contractual, or industry requirements. Cybersecurity, privacy, financial, healthcare, environmental, and safety audits address different risks, while internal, external, and regulatory audits differ by who does the work and how far the results can be relied on.
Choose the audit that matches your obligation, then act on the findings. That means fewer surprises, shorter audit cycles, and a compliance program that scales with the business.
Frequently Asked Questions
What are compliance audits?
They're reviews of policies, controls, records, and operations against specified laws, regulations, standards, contracts, or internal policies. The outcome depends on the framework and who performs the review.
What is the purpose of a compliance audit?
To identify gaps, verify controls work, support regulator or customer assurance, and guide corrective action. It's rarely a simple pass/fail exercise.
What is the difference between internal audit and compliance?
Internal audit is an independent assurance function; compliance is adherence to defined requirements. An internal team can run a compliance-focused audit, but it may not carry the weight of an independent one.
Who performs compliance audits?
Internal audit teams, external auditors, specialized consultants, certification bodies, and government agencies. Qualifications and authority vary by framework.
What are the three main types of audits?
Internal, external, and regulatory or government audits. Compliance audits can also be sorted by subject, such as cybersecurity, privacy, financial reporting, healthcare, environmental, or workplace safety.
How much does a compliance audit cost?
It depends on scope, framework, organization size, number of systems and locations, evidence maturity, duration, and whether it's a readiness review, certification, attestation, or regulatory exam. NIST guidance ties effort to assessment depth and coverage.
