What is an Authority Document?
Authority documents are the core of regulatory compliance, guiding organizations on how they should operate. When we refer to complying, we're acknowledging adherence to authoritative rules that have been developed beyond our control. These rules vary and include several different types of documents, each serving a unique purpose within the legal framework. They might include regulations, principles, standards, guidelines, best practices, policies, and procedures. Understanding the distinction between these documents and recognizing the role of various authoritative bodies is crucial.
Types of Authority Documents
The Unified Compliance Framework (UCF) lists the following types of authority documents.
Statutes (Bills or Acts)
Regulations
Regulatory Directive or Guidance
Contractual Obligation
International or National Standard
Audit Guideline
Safe Harbor
Best Practice Guideline
Vendor Documentation
Organizational Governance Documents
Let’s have a brief look at them.
Statutes (Bills or Acts)
Statutes represent formal laws created by governmental bodies such as federal, state, or provincial legislatures. They establish the legal framework for various subjects like the Civil Rights Act of 1964 or the Sarbanes-Oxley Act of 2002. Not adhering to statutory laws can lead to imprisonment or financial penalties.
Regulations
Regulations interpret and extend statutes, defining how laws should be implemented. Created by governmental agencies, they become enforceable documents by law. Traditional regulators play a crucial role in detailing and prescribing people's and businesses' behavior, and any deviation from regulations can result in penalties.
Regulatory Directives or Guidance
These are legislative or organizational acts, like those of the European Union or the U.S. Whitehouse's Office of Management and Budget (OMB). They require certain results without specifying the means, leaving some flexibility for interpretation. Their enforcement is limited to the specific groups they address.
Contractual Obligations
Contractual obligations, although not enforced by law, are enforced by contractual agreements. These can include self-regulatory bodies or standards organizations. Failure to adhere to these contractual standards may result in fines, loss of valuable rights, or even business closure. Examples include the Payment Card Industry Data Security Standard (PCI-DSS).
International and National Standards
Standards define the criteria set by governmental or industrial authorities to ensure quality or attainment. A popular example is the international standard for information security management systems, ISO 27001:20022. Though not enforceable by law, non-compliance may lead to actions against regulations.
Audit Guidelines
Audit guidelines like COBIT or those from the Payment Card Industry Data Security Standards Council derive their authority from contractual obligations and regulatory guidance. Failure to meet these guidelines can result in audit items and other enforcement actions depending on the underlying obligations.
Safe Harbors
Safe harbors are regulatory shortcuts designed to ensure compliance without exhaustive analysis. They offer protection but are not mandatory. Using safe harbors like the CobiT audit standards may reduce compliance risk but isn’t obligatory.
Best Practice Guidelines
These are unenforceable recommendations providing models or methods considered best in the industry. They must be evaluated and adapted to specific situations, and overly rigid adherence may sometimes lead to unnecessary costs.
Vendor Documentation
Vendor documentation often serves as best practices or minimum standards of care, particularly in areas like security measures. Compliance with regulatory guidance may elevate vendor documentation to a safe harbor status.
Organizational Governance Documents
Lastly, organizationally-documented controls encompass internal activities, policies, standards, and practices. They aim to ensure the achievement of business objectives and the prevention or correction of undesirable events.
Conclusion
Authority documents play a vital role in defining legal obligations and industry standards. Understanding the nuances between the different types is essential for any organization navigating the complex world of regulatory compliance. From strict regulations and statutes to flexible best practices and guidelines, these documents guide, govern, and influence the way businesses operate.
