Building a compliance obligations register: artefacts, owners and review cadence

What an obligations register is

An obligations register is a controlled list of every legal, regulatory, licence and contractual requirement that binds the entity, with a named owner, a citation to the source instrument, the control that satisfies it, and a date the entry was last verified. It is the spine of a compliance program: policies, monitoring plans, board reports and incident triage all reference back to it.

It is not a copy of the legislation, and it is not a to-do list. A register answers four questions on every row — what applies to us, who is accountable, how do we satisfy it, and when did we last check that answer is still correct.

Australian regulators rarely mandate a register in those words. What they mandate is the outcome the register produces. ACNC Governance Standard 3 requires a registered charity to comply with Australian laws — a duty that is unevidenced without a list of which laws the charity has identified. AFS licensees carry the general obligations in section 912A of the Corporations Act 2001, including adequate risk management systems. The recognised management-system standard for compliance is AS ISO 37301:2021 Compliance management systems — Requirements with guidance for use, which is paywalled through Standards Australia and is cited here by name only.

Rules Mate publishes the underlying corpus at /obligations, and the obligation finder and the Compliance Fingerprint both produce a starting shortlist for a given entity profile. Those are inputs. The register is the artefact you own, maintain and hand to an auditor.

The fields an auditor expects to see

Every row should carry the same fields, because an incomplete row is the one that gets tested. The minimum set:

The two fields most often missing are last verified and not applicable with reason. Both matter because an auditor is testing the maintenance process, not the spreadsheet.

Artefacts, owners and cadence

A register does not stand alone. It sits inside a small set of artefacts, each with an owner and a cadence:

The compliance calendar generator turns the frequency column into dated obligations, and /deadlines tracks the fixed national dates that apply regardless of entity profile. The 2026-27 compliance calendar sets out the recurring federal dates in one place.

Building the first version without boiling the ocean

Start with scope, not with law. Write down what the business actually does — the services sold, the data held, the people engaged, the premises operated, the money moved, the goods imported, the licences held. Each of those is a doorway into a regime.

Then work in four passes:

1. Entity-level duties. Company registration, director duties and director ID, annual review, financial reporting, tax registrations and lodgements, employment record-keeping, work health and safety primary duty.
2. Activity-triggered duties. Licensing, industry codes, product safety, privacy, anti-money laundering, environmental approvals, import and export controls.
3. Threshold-triggered duties. Regimes that switch on at a revenue, headcount, emissions or asset threshold — climate reporting, modern slavery statements, payroll tax, gender equality reporting.
4. Contractual duties. Customer contracts, funding agreements, franchise and supply agreements, insurance conditions. These are enforceable obligations and belong in the same register. A contract register feeds this pass.

Mark every row you cannot resolve as a gap rather than deleting it. A register with twelve open gaps and named owners is stronger evidence of a functioning program than a tidy register with silent omissions.

Keeping the register current

A register decays from the day it is signed. The maintenance mechanism is a regulatory change intake, run monthly:

• Monitor sources — regulator updates, the Federal Register of Legislation, state gazettes, industry association bulletins, and the Rules Mate changelog.
• Log each change with a date received, the instrument, and a first-pass impact call.
• Assess material changes against the register: does a row need new wording, a new control, a new owner, or a new date?
• Record the assessment outcome even where the answer is "no change required". Auditors test the negative decisions.

Set the register review as a standing quarterly item, with a full annual refresh where every row's last verified date is renewed against the source.

The evidence trail that survives an audit

Evidence is the artefact a third party can inspect without your commentary. For a register, that means:

• Version history. Dated versions, with a change log showing what moved and who approved it.
• Approval record. A minute or file note recording that the accountable body reviewed and accepted the register.
• Traceability. Each row links to the control document and, where the obligation is periodic, to the completed evidence for the last cycle.
• Retention. Keep register versions for at least the period that applies to the underlying records. Many Australian corporate and tax records carry a seven-year retention expectation; work health and safety incident records carry their own statutory minimum.

Storing the register in a spreadsheet is acceptable if version control is real. Storing it in a spreadsheet that is emailed around and edited without a change log is the finding.

Common failure modes

• Team ownership. "Finance" is not an owner. Name a role.
• Copying statutory text. A register full of quoted sections shows nobody translated the duty into an operational control.
• No "not applicable" reasoning. Exclusions carry more audit risk than inclusions.
• Register and calendar drift apart. If the calendar contains dates the register does not know about, one of them is wrong.
• No linkage to incidents. When something goes wrong, the incident record should cite the obligation ID it touched. Without that link, trend analysis is impossible.
• Annual-only review in a fast-moving regime. Where an entity sits inside a regime that is actively changing — anti-money laundering, privacy, climate reporting — quarterly is the floor.

Once the register exists, the next two artefacts follow directly: a risk register that sits alongside it, and a policy suite built to be auditable.