What is an Obligation Register?

What is an Obligation Register?

An obligation register is a maintained inventory of the legal, regulatory, contractual and voluntary obligations that apply to an organization, each mapped to an owner, the controls that meet it and the evidence of compliance.

ISO 37301:2021, the international standard for compliance management systems, requires an organization to systematically identify its compliance obligations, including both mandatory requirements and the commitments it chooses to make, to assess the compliance risks they carry, and to keep the obligations up to date as laws, products and the organization change. The standard does not prescribe a format, but a register is the practical answer, and it becomes the backbone that policies, controls, monitoring and audit refer back to. Regulators expect the same in substance: examiners of a compliance management system ask how the organization learns its responsibilities and how it knows they are met.

Why it matters

• You cannot comply with what you have not listed. Most compliance failures trace to an obligation nobody had assigned.
• It is the join between law and controls. The register is where a regulatory requirement is translated into who does what, evidenced how.
• It makes change manageable. When a rule changes, the register shows what is affected.

What each entry records

• Source: the law, regulation, license condition, contract, standard or internal commitment, with citation and jurisdiction.
• Obligation: the specific requirement in plain language, split so that one entry has one testable requirement.
• Applicability: which entities, products, processes and locations it applies to.
• Owner: the accountable role, and the compliance contact.
• Risk rating: consequence of a breach and likelihood, to prioritize monitoring.
• Controls and policies that satisfy it, and the evidence produced.
• Monitoring: how and how often adherence is checked, and the last result.
• Status and change history, including the horizon scanning item that introduced or amended it.

Sources of obligations

Laws and regulations in every jurisdiction of operation; conditions of licenses and authorizations; supervisory guidance treated as binding in practice; contracts with customers, suppliers and partners; industry codes and standards the organization has adopted; and its own policies and public commitments, including those on privacy, sustainability and conduct. ISO 37301 counts voluntary commitments as obligations once made.

Building and maintaining it

Start from the regulatory footprint (which regimes apply, where) and decompose each regime into requirements, working from official texts rather than summaries. Assign owners before adding controls, since ownership is what makes the register live. Link horizon scanning and regulatory change management to it so every change lands as an amended or new entry with an impact assessment. Review entries on a risk-based cycle and treat unowned or unmapped obligations as findings.

Related terms

• Compliance management
• Regulatory change management
• Regulatory compliance management
• Control mapping
• Policy management
• Compliance monitoring

In SmartSuite

SmartSuite Compliance Management holds the obligation register as linked records: each obligation connects to its source, owner, policies, controls, monitoring tests and evidence, and regulatory change items flow into it so the impact of a new rule is visible as the entries it touches.

Frequently asked questions

What is the difference between an obligation register and a control library?

The obligation register lists what the organization must do and why. The control library lists the activities the organization performs to meet requirements. They are linked many to many: one obligation may need several controls, and one control may satisfy obligations from several regimes. The register is the demand side; the library is the supply side.

How detailed should an obligation register be?

Detailed enough that each entry is one testable requirement with one owner. A regime such as GDPR becomes dozens of entries, not one. Group them by regime and topic for reporting, but keep the granular entries, because monitoring, control mapping and change impact all work at the level of the individual requirement.

Does ISO 37301 require an obligation register?

It requires the organization to identify its compliance obligations, assess the risks they carry and keep them current, and to document information the system needs. It does not mandate a register by name, but auditors expect to see a maintained inventory of obligations with owners and links to controls, which is what a register provides.