Following on from my previous post, the question is not simply when spreadsheets stop working—but what replaces them.
In many organisations, the starting point is a legal register.
This is typically a structured list of:
- Applicable laws and regulations
- Relevant articles or clauses
- Jurisdiction-specific requirements
It serves an important purpose—identifying what applies.
In some cases, this evolves into a compliance register, where organisations begin to:
- Interpret those requirements
- Link them to internal processes
- Assign high-level responsibilities
There is nothing inherently wrong with this approach. In fact, it is often the right place to begin.
The issue arises when these registers are expected to function as a system.
Where Legal and Compliance Registers Fall Short
A legal register may tell an organisation what laws, regulations, or articles apply.
But for management, that is rarely enough.
Not all requirements carry the same level of risk or urgency. Some may be administrative. Others may create significant exposure if missed.
Management typically needs to understand:
- What is the penalty for non-compliance?
- What is the associated risk—legal, operational, financial, or reputational?
- How should that risk be classified (e.g. negligible to unacceptable)?
- What actions should be prioritised?
- What is the cost of mitigation?
This is where many legal and compliance registers begin to fail.
They list requirements—but do not always support decision-making.
A legal register may show what applies.
A compliance register may begin to interpret those requirements.
But the real value is not in listing obligations. It is in turning obligations into informed decisions.
When a Register Is No Longer Enough
As compliance becomes more operational, a static register starts to show its limitations.
You may have:
- A well-structured list of obligations
- References to regulations
- Some level of ownership
But key questions remain:
- Who is actually accountable in practice?
- What actions are required, and by when?
- How is completion tracked?
- Where is the supporting evidence?
- What happens when requirements change?
At that point, the gap becomes clear.
A register records compliance.
A system manages it.
What a Compliance System Actually Looks Like
From experience working across complex projects in the region, effective compliance management tends to share a number of common characteristics—regardless of industry or whether formal certification is in place.
A functioning compliance system typically includes:
Clear ownership
Each obligation has a defined owner—not just in name, but in accountability.
Structured obligations
Requirements are broken down into actionable items, not just high-level regulatory references.
Defined workflows
Actions, deadlines, and dependencies are clearly mapped and tracked.
Evidence capture
Completion is supported by documentation, records, or verification—not assumed.
Visibility
Management can see the status of compliance across sites, projects, or business units in real time.
Traceability
There is a clear record of what was done, when, and by whom.
Beyond Certification
These principles are reflected in frameworks such as ISO 14001 and ISO 45001. However, in practice, many organisations operate in this way regardless of whether they are formally certified.
The drivers are operational:
- Increasing regulatory scrutiny
- More complex project structures
- Greater expectations around accountability and reporting
In that environment, compliance needs to be demonstrable—not just documented.
A Shift in Mindset
The transition from a register to a system is not primarily about tools.
It is about a change in mindset:
- From listing requirements → to managing obligations
- From assigning responsibility → to ensuring accountability
- From storing information → to enabling action
- From periodic review → to continuous visibility
This is where many organisations begin to strengthen their approach.
What Comes Next
As compliance systems become more structured, another challenge starts to emerge.
Responsibilities that were once clearly defined begin to overlap.
Environmental, health and safety, security, and operational requirements increasingly intersect—often around the same events, risks, or activities.
That overlap introduces a new level of complexity.
And in practice, it is where many compliance systems are put to the test.
I’ll explore that in the next post.
- From Compliance Registers to Compliance Systems: What Good Looks Like - April 28, 2026
- When Spreadsheets Stop Working: Scaling Compliance Management into a System - April 25, 2026
- Is Your Business Compliant with HSE Regulations? Take Our Quiz to Find Out! - September 16, 2024