After reading, you can set up a simple cycle that links each obligation to an owner, a control and its evidence.
Definition
An obligation is anything the company must follow or has chosen to follow: a law, a contract clause, a standard, an internal commitment. ISO 37301 sets out the requirements for a compliance management system built around them.
Because the texts change and the business changes with them, the work never reaches a finish line. It runs as a cycle.
Why it matters
When a company misses an obligation, the cause is seldom a refusal to comply. More often nobody knew it was theirs. The price can be a fine, a lost contract or a blocked sale.
There is a practical gain as well. One access review may answer six different texts, and only a shared view of obligations will reveal that.
How it works
List what applies and say why, with the text, the article and the activity concerned. Then give each obligation an owner.
Connect each one to the controls, policies and records that satisfy it. The gaps then become visible, and you can plan their correction, starting with those that could stop a sale or lead to a penalty.
Finally, set a rhythm: monitor, report to management, and keep someone watching for new texts and changes in the business.
A worked case
A payment software company with 80 staff lists 46 obligations: the GDPR, requirements its bank customers pass on from DORA, and contract clauses. Its quarterly access review turns out to answer six of them, so it becomes one control, with one owner and one record.
The first gap assessment finds nine gaps. The two tied to a customer contract get closed first.
Good practices
- Keep a single register of obligations, showing the source and the owner of each.
- File evidence as it is produced. Rebuilding it the month before an audit costs far more.
- Give management a short, regular view of open gaps and overdue actions.
- Assign one person to follow changes in the texts, so that the task has a home.
Common mistakes
- Preparing only for the yearly audit, which leaves eleven months of drift.
- Handing all of compliance to one person who owns no process. They end up chasing others without any power to decide.
- Counting a policy as proof. A signed document shows an intention, and an auditor will ask to see the practice.
- Overlooking contracts. Customer clauses often go further than the law, and sales may be the only team that has read them.
Questions
- What is the difference between compliance and governance?
- Governance is how a company directs itself and takes decisions. Compliance is the part that makes sure it meets its obligations.
- Is compliance management the same as being certified?
- No. A certificate covers one standard and one scope. Compliance management covers every obligation, and many of them have no certificate at all.
- Who is responsible for compliance in a company?
- Management stays accountable. A compliance lead coordinates, and each process owner meets the obligations in their own area.
- Is ISO 37301 certifiable?
- Yes. It contains requirements, and certification bodies audit against them.
- Where should a small company begin with compliance?
- With the list of its obligations and their owners, starting from whatever can stop a sale or trigger a penalty.