How leadership can know, with evidence, whether the organization's legal and regulatory obligations are identified and met

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

The corpus states the span of this outcome in one sentence: its legal and regulatory compliance policy establishes the framework for identifying, interpreting, tracking, implementing, and reporting compliance with legal and regulatory obligations across all jurisdictions where the organization operates (its section 1). This page maps the corpus documents along that framework to a single outcome:

Leadership can state, with evidence, whether the obligations that apply to the organization are identified, owned, and met, and can see which obligations stand short of that state.

The first half of the outcome concerns the obligation inventory and the controls that answer it. The second half concerns the standing of each obligation, which the corpus records deliberately: the compliance obligations register template records each obligation's standing in the status vocabulary its Compliance status definitions section defines and records known gaps between requirement and implementation in its control-mapping fields (its Register schema), and the policy lists obligation coverage completeness among the compliance indicators its section 10.2 names. The assembly of the corpus documents below into one path, and the reading order, are a composite synthesis across the sources this page lists; the limitations say so.

Each row relates one corpus control to the outcome using exactly one of the narrative layer's four relationship words. A contribution materially advances the outcome without being sufficient for it; a dependency is a condition the outcome requires; a prevention reduces the opportunity for a named failure mode; evidence demonstrates that a control exists or operates. No stronger relationship word appears on this page, by design. Where a row's justification is the cited document's own stated purpose, the row paraphrases it closely; the assignment of exactly one word per row is a composite reading, and the limitations carry that caveat.

• The corpus states the path's couplings document by document: the register template's population guidance draws applicability from the applicability register (its Step 1) and routes unmapped obligations to the CAPA procedure (its Step 3); its integration table feeds higher-risk obligations to the enterprise risk register and the register itself into audit planning (its Integration with other processes section); and the legal and regulatory compliance policy logs regulatory updates into the register and routes them through change management (its section 5.4). The reading of the eight rows as one ordered path is this page's synthesis, not any single document's statement; the limitations flag it as composite.
• The corpus separates identifying an obligation from meeting it: the register template records implementation status and compliance status as distinct fields (its Register schema), and its status definitions reserve their highest standing for requirements implemented and verified through evidence (its Compliance status definitions section).
• The corpus deliberately does not state that any law applies to an adopting organization: the applicability register's purpose and maintenance rules place the applicability determination, and its documented basis, with the adopting organization, and the obligations register is a template whose populated content, the applicable regimes, the obligations, their deadlines, and their statuses, is the organization's own.
• Framework-alignment traceability exists and states its own limits: the compliance alignment matrix maps library documents to the control domains and section references of the frameworks its column key lists, and its notes state that the matrix is indicative only and that formal certification, audit, or regulatory use requires an engagement-specific review by qualified practitioners (its Notes section).
• Deviations have a recorded route, not a silent one: deviations from policy, control, or standard requirements are risk assessed, time bound, approved at the authority level the exception and risk acceptance management policy's section 4.2 sets, and tracked in a central register (its Purpose and its section 4.5).

Each item below is an evidence class leadership can ask management for, for a sampled obligation. Each is evidence for a named layer of the map operating.

• The applicability record for the sampled obligation's regime, with its documented applicability basis, as evidence for the applicability layer in the global regulatory applicability register.
• The register extract for the sampled obligation, with its owner, its source reference at the granularity the template requires, its mapped controls, its implementation and compliance statuses, and its review dates, as evidence for the inventory layer in the compliance obligations register template.
• The period's regulatory-update log entries and their change-management routing, as evidence for the horizon-scanning layer in the legal and regulatory compliance policy's section 5.
• The evidence linkage for the sampled obligation, with its audit validation, as evidence for the mapping layer in the legal and regulatory compliance policy's sections 4.3 and 7.1.
• The most recent compliance-audit report covering the sampled obligation's domain, with its findings and management response, and the audit plan entry that scheduled it, as evidence for the audit layer in the internal audit standard and the audit planning procedure.
• The corrective-action records raised on compliance gaps in the period, with their closure verification evidence, as evidence for the correction layer in the CAPA procedure.
• The regulatory and external-environment section of the latest board risk report, and the latest compliance-indicator review record, as evidence for the reporting layer in the board risk report template and the legal and regulatory compliance policy's section 10.
• Any approved exception touching the sampled obligation's mapped controls, time bound and tracked per the exception and risk acceptance management policy's sections 4.3 and 4.5, as evidence for the accepted-deviation route in that policy.

• This page creates no compliance and imposes no requirement. The linked corpus documents govern; where this page differs from a corpus document, the corpus document prevails.
• This page carries composite claims. The assembly of the listed corpus documents into a single path, the reading order, the two-part outcome framing, the reading of the policy's centralized register requirement and the register template's structure as one inventory layer, and the assignment of exactly one relationship word per row are synthesized across the sources named above; a control can serve the outcome in more than one way, and the map records the primary relationship. The adopting organization validates that reading against its own compliance management model.
• The specific values live in the corpus documents and with the adopting organization, inside the structures this page links: the register's field and status definitions, source-reference granularity requirements, risk-rating criteria, and review cadences; the finding classifications, escalation and validation timelines, and retention requirements of the audit and CAPA documents; and the exception authorities, durations, and renewal ceilings. This page routes to those documents and reproduces no value.
• The obligations themselves are the adopting organization's own. The obligations register this page describes is a template; which regimes apply, which obligations follow, and what standing each holds exist only in the organization's populated register, and this page states no jurisdiction's legal or regulatory requirements. Organizations validate their obligations with legal or compliance advice, which may exceed anything described here.
• Adoption is not presented as effectiveness. Holding the documents this page links, or requesting the artefacts it names, is not evidence that any obligation is identified or met in an adopting organization; the register template's own status definitions reserve their highest standing for requirements implemented and verified through evidence, and only the organization's populated register, audit results, and corrective-action records speak to that standing.
• The body and role names this page's sources use (governing body, audit and risk committees, compliance function, internal audit function, obligation owner) are the corpus's reference vocabulary; an adopting organization maps them onto its own structure.
• This page makes no claim about the likelihood, occurrence frequency, or magnitude of a compliance failure, an enforcement action, or an outcome, and none of its statements should be read as a probability; the review and reporting cadences it points to are the cited sources' own, routed and not reproduced.