For most regulations, the laws and rules say something like "companies must ensure X doesn't happen", and the companies themselves have to come up with a way to do that.

Let's say the law says "companies that transport apples must be able to show which batch went where".

Company A says "to comply with the law, whenever we move a shipment, we store the shipping order on our computers"

Company B says "to comply with the law, the truckdriver will film the place they left, count the apples when leaving, then email the entire dashcam trip, and count the apples on arrival".

Neither process is wrong, they both follow the law. But when I go to Company B, I promise you they're going to fail the audit. They're (probably) not doing anything illegal, but they're going to fail their audit because no truckdriver is going to count a truck full of apples.

They made that rule, and they really didn't have to.

there are 2 types of rules, or controls as we call it: Legal requirements and internal policies. The first one is clear there are legal requirements in place and you have to be in compliance with. The second one is where I get the most wtfs. Internal policies are rules the company itself crated and said had to be followed. For example let's say you are the IT manager of your company and you discover that everyones password to you system is 1234. You go out and look for market best practices and create a policy saying "All passwords must contain 6 numbers and 2 letters". For this to be official you write it down and "publish" it internally.

Now, me as an auditor go there, look at the rule you created and check if it's really in place or if you just wrote because. A lot of times it's not. The company creates the rule but forgets or just postpone implementing it