What is the fundamental difference between compliance and internal audit?

Compliance (the Second Line under ISO 37301) is an ongoing operational management function that designs rules, policies, and control gates, trains staff, and vets transactions in real time to prevent violations. Internal audit (the Third Line under DSTU ISO 19011) is an independent, periodic verification activity that samples objective evidence to test whether those rules and controls actually work in practice.

Which international ISO standards govern compliance management and auditing?

The primary international standard for a Compliance Management System is ISO 37301:2021 (which replaced ISO 19600 and is a certifiable requirements standard). Anti-bribery compliance is governed by DSTU ISO 37001:2018 (Anti-bribery management systems), whistleblowing management systems follow ISO 37002:2021, and the methodology for planning and conducting management system audits is defined in DSTU ISO 19011:2019.

For which Ukrainian companies is an Anti-Corruption Program mandatory by law?

Under Articles 61-62 of the Law of Ukraine 'On Prevention of Corruption' No. 1700-VII, a formal Anti-Corruption Program and a designated Compliance Commissioner are mandatory for state and municipal enterprises (exceeding statutory headcount and revenue thresholds) as well as all private companies bidding on public and defense procurement tenders valued at 20 million UAH or more.

What are First-Party, Second-Party, and Third-Party audits?

Under DSTU ISO 19011 classification: a First-Party audit is an internal audit conducted by the company across its own departments (either with trained internal staff or outsourced audit experts); a Second-Party audit is a customer audit of a supplier or subcontractor under contract; a Third-Party audit is an independent certification audit performed by an accredited Certification Body (for ISO 9001, FSSC 22000, ISO 27001, or ISO 37001) or a statutory inspection.

Can one specialist serve as both Compliance Officer and Internal Auditor?

No, not for the same processes. Doing so creates a direct conflict of interest and violates the principle of audit independence under DSTU ISO 19011. A specialist who drafted a compliance procedure or approved counterparties cannot objectively audit their own work. Auditing the compliance and quality functions requires either independent internal auditors from other departments or outsourced lead auditors.

How often should internal compliance and management system audits be conducted?

Audit frequency is determined using a risk-based approach (Clause 5.3 of DSTU ISO 19011). All processes within the scope of an ISO management system (ISO 9001, ISO 14001, ISO 27001, ISO 37001) must be audited at least once every 12 months, while high-risk processes (procurement, tender bidding, cash handling, personal data protection, critical manufacturing lines) should be audited quarterly or semi-annually.

Where should a mid-sized company start when implementing compliance and internal auditing?

An effective launch follows four steps: 1) conducting a Diagnostic Gap Analysis to identify regulatory, contractual, and sanctions vulnerabilities; 2) compiling a Compliance Obligations Register and Risk Matrix; 3) implementing counterparty Due Diligence and four-eyes financial approval gates; and 4) training an internal audit team under ISO 19011 to start regular verification cycles.

Back to Resources

Audit and Compliance Management: Differences Under ISO 37301 and ISO 19011, the Three Lines Model, and KPI Matrix

Difference between internal audit (ISO 19011) and compliance management (ISO 37301, ISO 37001): the Three Lines Model, third-party due diligence, and KPIs.

Published February 9, 202614 min read

By: Denys Honchar

CEO of Ekontrol

Architecture of an enterprise compliance management system (ISO 37301) and internal audit program (ISO 19011) under the Three Lines Model

Need a certification consultation?

Free Consultation

What Compliance Management (ISO 37301) and Management System Auditing (ISO 19011) Mean in Practice
The IIA Three Lines Model: How to Separate Operational Compliance from Internal Audit
Five Mandatory Compliance Domains for Ukrainian Businesses in EU Trade and Public Tenders
Audit Classification Under ISO 19011: First-Party, Second-Party, and Third-Party Audits
Measurable Compliance and Internal Audit KPIs: Leading and Lagging Indicator Matrix
Five-Stage Implementation Roadmap for Compliance and Risk-Based Auditing
Six Common Compliance and Internal Audit Mistakes Flagged During External Inspections

Frequently Asked Questions

Find answers to common questions about this topic

Related resources

Articles, courses and news on the topic to go deeper.

Audit and Compliance Management: Differences Under ISO 37301 and ISO 19011, the Three Lines Model, and KPI Matrix

On This Page

Frequently Asked Questions

Tags

Related resources

Audit and Compliance Management: Differences Under ISO 37301 and ISO 19011, the Three Lines Model, and KPI Matrix

On This Page

Frequently Asked Questions

What is the fundamental difference between compliance and internal audit?

Which international ISO standards govern compliance management and auditing?

For which Ukrainian companies is an Anti-Corruption Program mandatory by law?

What are First-Party, Second-Party, and Third-Party audits?

Can one specialist serve as both Compliance Officer and Internal Auditor?

How often should internal compliance and management system audits be conducted?

Where should a mid-sized company start when implementing compliance and internal auditing?

Tags

Related resources

How to Prepare for ISO Certification Audit in 90 Days: Practical Week-by-Week Plan

ISO Certification in Ukraine and for Export: Comparing Core Standards, NAAU/IAF Accreditation, and Verifying Legitimate Certificates

Internal Quality Audit: 4 Stages for Consistent Results