I remember exchanging emails with Charles Cianfrani ( author of ISO 9001: 2000 explained) when we were going to ISO 9001: 2000 requirements. I felt strongly that regulatory requirements could be, but did not have to be within the scope of process audits. My arguement was that there is no way a quality system auditor could be held responsible for knowing legal requirements especially if the company had international clients. I always thought as long as a process exists and is effective to deal with regulatory requirements that I, as an quality system auditor did not have to ensure these requirements are met through audits done to the ISO 9001: 2000 standard. He disagreed and said I should at least be sampling to some legal requirements during my audits. To this day I have not and never had an issue with my registrar. I can't remember our registrar ever doing such a compliance audit or even taking a sample to see if some legal or regulatory standard was met.
We have people in legal, environmental and health audit to those requirements at the site level around the globe with their federal agencies as the oversite, those audits, are totally separate from our audits to ISO 9001, 14001, and 18001. I guess my point is that you don't need to do compliance audits to satisfy IsO audits, and secondly, the experts are not always right.
