External Audit: How to Prepare the Sample of Legal Requirements

Preparing for an external audit can be a significant challenge for any organization. One of the crucial steps in this process is preparing the sample of legal requirements, which includes the selection, tracking, and assignment of responsibility for each piece of evidence. This article describes how to effectively approach this task, focusing on ISO standards and common practices in Brazil.

Understanding the Sampling of Legal Requirements

The sampling of legal requirements is a process by which an organization identifies which applicable laws, regulations, and standards should be verified during an external audit. In the context of ISO standards, such as ISO 14001 and ISO 45001, this involves demonstrating compliance with environmental and occupational health and safety requirements, respectively.

In Brazil, this may include compliance with standards such as NR-12, which addresses workplace safety in machinery and equipment, and RESOLUÇÃO-RE N° 3.165, DE 13 DE AGOSTO DE 2026, which may establish new regulatory requirements for the health sector.

Selection of Evidence

The first step in preparing the sample is the selection of evidence. This involves identifying documents, records, and other materials that prove compliance with relevant legal requirements. To ensure proper selection, consider the following aspects:

• Relevance: Choose evidence that is directly relevant to the legal requirements in question. This may include environmental licenses issued by IBAMA or reports from previous internal audits.
• Timeliness: Ensure that the evidence is up-to-date. Outdated documents may raise questions about the organization's ability to maintain continuous compliance.
• Completeness: The evidence must cover all aspects of the legal requirement. For example, if a requirement demands an emergency plan, the document should include all necessary details, such as evacuation routes and emergency contacts.

Tracking Evidence

After selection, it is essential that the evidence is traceable. This means it should be possible to quickly locate any requested document or record during the audit. To facilitate this process, adopt the following practices:

• Cataloging: Use a document management system to catalog and store evidence in an organized manner. Digital systems can facilitate the search and retrieval of information.
• Indexing: Identify each piece of evidence with a unique code that allows for easy location. This may include the document's identification, creation date, and current version.
• Change History: Keep a record of all changes made to documents, including who made the change and when. This helps ensure that the evidence is current and accurate.

Assignment of Responsibility

For each piece of evidence, there should be a designated responsible party. This is the individual or team responsible for ensuring that the evidence is correct, up-to-date, and ready for presentation. Assigning clear responsibilities helps avoid confusion and delays during the audit.

• Role Definition: Clarify who is responsible for each type of document. For example, the environmental department may be responsible for environmental impact reports, while the occupational safety department handles equipment inspections.
• Training: Ensure that those responsible are trained to understand legal requirements and know how to maintain the evidence in compliance.
• Monitoring: Conduct periodic reviews to verify that responsible parties are fulfilling their obligations. This may include regular meetings to discuss the status of the evidence.

Common Mistakes and How to Avoid Them

During the preparation process for an external audit, some common pitfalls can compromise the effectiveness of the sampling of legal requirements:

• Underestimating Requirements: Failing to consider all applicable requirements can lead to non-compliance. Use a comprehensive checklist to ensure all aspects are covered.
• Lack of Updates: Outdated or forgotten documents can be problematic. Establish a regular schedule to review and update documents.
• Inadequate Communication: Lack of communication between teams can result in documentation gaps. Promote collaboration between departments to ensure everyone is on the same page.

When to Seek an Expert

In many cases, it may be beneficial to seek the assistance of a compliance expert or an experienced external auditor. Navigating the complex Brazilian regulatory environment can be challenging, especially for companies operating in highly regulated sectors. An expert can assist in identifying specific requirements, guide on best documentation practices, and provide an objective assessment of the organization's readiness for the audit.

In summary, preparing a sample of legal requirements for external audits is a critical task that requires meticulous attention to detail. Correct selection of evidence, effective tracking, and clear assignment of responsibilities are key to success. Adopting a structured and proactive approach can not only facilitate the audit process but also strengthen the organization's ability to maintain continuous compliance.

For more guidance on how to prepare for external audits and ensure compliance with ISO standards, Legnova offers specialized consulting to help your organization achieve its regulatory compliance goals.