When a new regulation or customer condition arrives, compliance management should identify which process changes and who confirms completion. This approach maps obligations to work so that updated information leads to action instead of simply adding another list.
Who may need this and when
Organizations operating across jurisdictions, facing more contractual commitments, or seeing the same nonconformities recur can begin by reviewing key obligations and processes. Legal or compliance staff can provide expertise, while operating units must participate in implementation.
Common business challenges
A regulatory register has a current date, but work instructions are not updated. Sales commits to a contract condition, while procurement and site teams do not know what evidence to retain. Without connecting applicability, owners, and evidence, managers cannot judge implementation.
Approach and applicable requirements
ISO 37301:2021 and Amendment 1:2024 set requirements and guidance for a compliance management system covering relevant legal, contractual, and voluntary obligations. ISO confirmed in 2026 that the standard remains current; this confirmation did not publish a new 2026 edition. See the ISO overview.
Possible project scope, subject to agreement:
- Obligation sources and applicability: list sources, activities, and update contacts; refer legal interpretation or specialist questions to qualified personnel and retain the basis.
- Connect obligations to departmental work: map priority obligations to approvals, checks, deadlines, and evidence; identify procedures and training that must change when obligations change.
- Reporting, sampling, and improvement: arrange intake and corrective-action follow-up, use real work samples to review implementation, and submit recurring gaps for management decisions on resources and ownership.
Support and work stages
- Select activities and key obligations; define jurisdictions and processes and collect known requirements and questions without measuring completeness by list length.
- Assign implementation and update responsibilities; map obligations, processes, owners, and evidence and agree on change notices and escalation.
- Review representative work cases and identify differences in staff understanding, procedures, and records.
- Review reports, internal audits, and management-review items to confirm whether actions reduce recurring issues.
Possible deliverables include an obligations and applicability register, process-owner and evidence matrix, update-notification method, and review and improvement records. A reviewer should be able to trace an obligation to work, its owner, and actual evidence.
Information to prepare
- Business activities, jurisdictions, and organizational responsibilities.
- Existing legal, contractual, and voluntary obligations and specialist applicability assessments.
- Process, approval, and compliance-check information.
- De-identified nonconformities, reports, training, and improvement records.
Start with an information index and de-identified examples. Share project data only after purpose, access, and retention are agreed.
Schedule and fees
Effort depends on jurisdictions, obligation types, processes, and data gaps. Legal interpretation, litigation, and specialist advice need separately agreed responsibilities and fees. Any external certification requires confirmation of the scheme and assessment scope.
Frequently asked questions
Does a current register prove compliance?
It is only a starting point. Confirm applicable activities, implementation, and evidence, then address identified gaps.
Will a consultant provide every legal conclusion?
This work addresses management processes. Qualified professionals should confirm legal opinions by jurisdiction and case.
Do we only manage statutory requirements?
Relevant contracts and voluntary commitments can also create compliance obligations and should be identified based on activities.
Does a small company need a separate compliance department?
The system can scale to size and risk. Clear ownership, professional support, and effective implementation matter.
Can this integrate with anti-bribery work?
Governance, training, and audits can be coordinated, while anti-bribery-specific risks and controls remain defined.
Does certification remove legal liability?
System assessment does not replace legal responsibilities or a comprehensive legal review. Certificate scope and use also need confirmation.
Related services
Choose one obligation that is difficult to implement after an update and bring its source and current workflow to discuss responsibilities and evidence. Contact Captain International.