Compliance Management Basics

Information only — not legal advice.

Compliance management turns applicable obligations into work that people can perform and demonstrate. It begins by determining which requirements actually apply to the organisation, activity, location and contract.

A long list of laws and standards is not enough. The team needs to know the specific obligation, its owner, the action required and the evidence that the action occurred.

Keep different sources distinct

An obligation may arise from legislation, a regulator's binding decision, a contract or an internal policy. A voluntary standard or guidance document may become relevant because a contract adopts it, but its publication does not automatically make every clause a legal duty for every organisation.

Record the authoritative source, applicable version and relevant provision. Distinguish a proposal or draft from an enacted requirement, and an enactment date from an application or transition date. These distinctions are particularly important when writing public guidance about changing legislation.

Build a usable obligations register

For each material obligation, record:

• The activity and entities to which it applies, including exclusions or thresholds that matter.
• The requirement in plain language, linked to its authoritative source.
• The accountable owner and supporting operational procedure.
• The evidence retained and its location.
• Any deadline, review trigger, exception or unresolved interpretation.

Keep legal analysis and operational instructions connected. If applicability is uncertain, record the question and obtain appropriate advice; do not silently convert uncertainty into a “compliant” status.

Example: a contract requires a monthly inspection record

A fictional service contract requires an inspection report within five working days after each month ends. The team identifies the assets covered, who performs the inspection, who reviews the report and how the recipient acknowledges delivery.

The evidence is the completed inspection, review and issue record. A policy saying “we perform monthly inspections” does not show that the particular month's obligation was met.

If the contract changes, the owner checks the schedule, forms, responsibilities and evidence rules together. Updating only the register leaves the real work unchanged.

Test operation, not just documentation

Sample completed activities and trace them back to their requirement. Can the responsible person explain the rule? Does the evidence cover the correct period and scope? Are missed deadlines and exceptions visible? Do corrective actions address recurring causes?

Use findings to improve the process. Avoid presenting an internal review as independent certification or a checklist score as a legal conclusion.

Maintain the register

Review it when laws, contracts, services, locations or suppliers change. Preserve the basis for earlier decisions so that historical work is assessed against the requirements applicable at that time. Record who confirmed a change and when the operational procedure took effect.

ISO 37301 provides a compliance-management-system reference. Its existence does not determine which legal provisions apply to a particular project. The GDPR text on EUR-Lex is an example of an authoritative legal source; its applicability and specific duties still need assessment for the processing involved.

Read next: information governance and traceable approval workflows.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.