For most regulations, the laws and rules say something like “companies must ensure X doesn’t happen”, and the companies themselves have to come up with a way to do that.
Let’s say the law says “companies that transport apples must be able to show which batch went where”.
Company A says “to comply with the law, whenever we move a shipment, we store the shipping order on our computers”
Company B says “to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival”.
Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they’re going to fail the audit. They’re (probably) not doing anything illegal, but they’re going to fail their audit because no truckdriver is going to count a truck full of apples.
They made that rule, and they really didn’t have to.
For most regulations, the laws and rules say something like “companies must ensure X doesn’t happen”, and the companies themselves have to come up with a way to do that.
Let’s say the law says “companies that transport apples must be able to show which batch went where”.
Company A says “to comply with the law, whenever we move a shipment, we store the shipping order on our computers”
Company B says “to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival”.
Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they’re going to fail the audit. They’re (probably) not doing anything illegal, but they’re going to fail their audit because no truckdriver is going to count a truck full of apples.
They made that rule, and they really didn’t have to.