How to Track Compliance Obligations
Tracking compliance obligations is the process of identifying, documenting, monitoring, and evidencing all regulatory, legal, and internal requirements an organization must meet. This guide walks through establishing a compliance obligation tracking system that ensures nothing falls through the cracks.
Step 1: Identify Your Regulatory Landscape
Start by mapping your regulatory landscape: which regulations apply to your organization based on your industry, jurisdictions, and business activities. Use regulatory intelligence services, legal counsel, and industry associations to identify applicable regulations. Document each regulation with its source, jurisdiction, and regulator.
Step 2: Extract Specific Obligations
For each regulation, extract the specific obligations — the things you must do or not do. This is the most time-consuming step but the most important. Each obligation should have: a clear description, source reference (regulation, section), jurisdiction, and applicable entities. MPG's obligation extraction tools can help automate this process.
Step 3: Assess Applicability
Not every obligation in a regulation applies to every organization. Assess each obligation: applicable, partially applicable, not applicable, or under review. Document the rationale for the assessment. This ensures you focus your compliance efforts on obligations that actually apply, rather than trying to comply with everything.
Step 4: Assign Owners and Set Monitoring
Each obligation needs a clear owner — the person accountable for ensuring compliance. Assign owners based on role and expertise. Set monitoring frequencies based on risk: continuous for high-risk obligations, quarterly or annual for lower-risk. Define what evidence is needed to demonstrate compliance and how it will be collected.
Step 5: Establish Compliance Status Tracking
Track the compliance status of each obligation: compliant, mostly compliant, partially compliant, non-compliant, or not tested. Update status regularly based on monitoring activities. When status changes (e.g., from compliant to non-compliant), document the reason and create a remediation action.
Step 6: Monitor Deadlines and Alerts
Many obligations have deadlines — filing dates, renewal dates, reporting dates. Track all deadlines with automated reminders that escalate as the deadline approaches. Set up alerts for upcoming deadlines, overdue deadlines, and status changes. MPG's deadline tracking with automated alerts ensures you never miss a compliance deadline.
Step 7: Report and Review
Regularly report compliance status to management and the board. The report should include: overall compliance status, non-compliant obligations, overdue deadlines, and remediation progress. Review the obligation register periodically to ensure it's current — add new obligations as regulations change, update status as monitoring occurs, and remove obligations that are no longer applicable.
Key Takeaways
- Start by mapping your regulatory landscape and extracting specific obligations
- Assess applicability to focus on obligations that actually apply
- Each obligation needs an owner, monitoring frequency, and evidence requirements
- Track compliance status and deadlines with automated alerts
- Report regularly to management and the board
Frequently Asked Questions
How do we handle obligations across multiple jurisdictions?
Each jurisdiction may have different requirements. Track obligations by jurisdiction, assign owners familiar with local requirements, and monitor regulatory changes in each jurisdiction. MPG's compliance obligation register supports multi-jurisdiction tracking with jurisdiction-specific deadlines and requirements.
What if we find we're non-compliant with an obligation?
Document the non-compliance, assess its impact, notify the relevant stakeholders (owner, compliance function, potentially the regulator), and create a remediation plan with an owner and due date. MPG tracks non-compliance through to remediation with full audit trails. Being transparent about non-compliance and having a remediation plan demonstrates governance maturity.