2 Documenting Compliance Obligations

What compliance obligations include

A compliance obligation is a requirement an organization must meet or a commitment it has voluntarily made. ISO 37301 treats both mandatory requirements and voluntarily adopted commitments as compliance obligations.

Obligations may arise from laws and regulations, permits, contracts, court or regulator decisions, industry codes, and internal policies. An obligations register turns these requirements into a working record to help people understand what applies, who is responsible, what action is required, and what evidence can demonstrate performance.

Translate requirements into testable obligations

Begin with an authoritative source and identify the specific requirement that applies to the organization. Translate it into a clear statement of the action or outcome required; copying broad legal language without explaining its operational meaning may not make the obligation assessable.

A testable obligation identifies who must do what, when or how often, and what record or result shows completion. For example, “Comply with employee training requirements” is vague. A more testable statement is: “The site training coordinator ensures each employee who handles regulated materials completes the required training before performing that work; completion records are retained in the training system.” This identifies a role, a trigger, an action, and evidence.

When a source contains multiple duties, record them separately if they have different owners, deadlines, applicability, or evidence. Separating such duties can make assessment more precise.

Determine applicability and ownership

An obligation may apply only to certain locations, activities, products, legal entities, employees, or business partners. Record the applicability basis, including relevant boundaries or exclusions. Do not mark a requirement “not applicable” merely because it is inconvenient or unfamiliar; document the reason and supporting basis, and have the decision reviewed by an appropriate person.

Assign an owner responsible for putting each obligation into practice. The owner may be a role or function rather than a named individual, so the assignment remains useful when personnel change. Where helpful, distinguish the operational owner from a compliance reviewer or approver.

Build a useful obligations register

An obligations register may be a controlled spreadsheet, database, or other searchable record. Its fields should suit the organization’s needs. Common fields include:

• Obligation ID: A unique, stable reference.

• Source and citation: The issuing authority or contracting party, document title, relevant section, and a link or location for the authoritative text.

• Requirement summary: A concise, faithful summary of the applicable requirement.

• Testable obligation: The action or outcome the organization must achieve.

• Applicability: The relevant entity, site, activity, product, people, or other scope, together with the basis for the decision.

• Owner: The role or function accountable for implementation.

• Timing or frequency: A deadline, trigger, or recurring interval, where specified or operationally needed.

• Evidence: Records, system outputs, approvals, measurements, or other proof expected to demonstrate performance.

• Review details: The last verified date, reviewer, next review trigger or date, and change notes.

For example, a permit may require a facility to submit a discharge-monitoring report by a stated date each quarter. The register could identify the permit and reporting clause as the source, specify the named facility and discharge as the applicable scope, assign the environmental manager as owner, record the quarterly deadline, and identify the submitted report and submission confirmation as evidence. The exact obligation and evidence depend on the permit’s text and the organization’s circumstances.

Maintain reliable records

Use authoritative source documents and record enough detail to find the exact clause again. Record the source’s version or effective date when relevant, and distinguish the requirement itself from the organization’s interpretation or internal procedure. If interpretation is uncertain, flag the issue for qualified review rather than presenting an assumption as settled fact.

Make register changes traceable by identifying who updated an entry, when, and why. Preserve prior versions as appropriate. Review entries when laws, permits, contracts, operations, or organizational scope change; periodic review helps keep the register aligned with current risks and business activities.

Use the register to support assessment

A well-maintained entry makes assessment more concrete: compare the testable obligation with the evidence and determine whether the required action occurred, on time, and for the applicable scope. Missing, incomplete, or contradictory evidence may indicate a gap that needs investigation, but it does not automatically establish that a legal violation occurred.

Record assessment results and follow-up actions in the appropriate compliance process. Effective programs use risk assessment, monitoring, and periodic review to improve controls and address changing risks. The register is a practical map for managing and assessing obligations, not a substitute for the authoritative requirement or for evidence of actual compliance.