there are 2 types of rules, or controls as we call it: Legal requirements and internal policies. The first one is clear there are legal requirements in place and you have to be in compliance with. The second one is where I get the most wtfs. Internal policies are rules the company itself crated and said had to be followed. For example let's say you are the IT manager of your company and you discover that everyones password to you system is 1234. You go out and look for market best practices and create a policy saying "All passwords must contain 6 numbers and 2 letters". For this to be official you write it down and "publish" it internally.

Now, me as an auditor go there, look at the rule you created and check if it's really in place or if you just wrote because. A lot of times it's not. The company creates the rule but forgets or just postpone implementing it