A compliance management system stands or falls on one question an auditor will ask early: can you produce a complete list of the obligations you are subject to? The compliance obligations register is that list, and building it properly is most of the work. 24 editable files, downloadable the moment you check out. On this page:
- What is in the compliance obligations register pack
- ISO 37301:2021 is current and recently reconfirmed
- Who needs compliance obligations register
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the compliance obligations register pack
Documents carry GD-CMS reference codes, deliberately kept to a manageable set rather than padded:
- CMS Manual – the compliance management system scope, structure and how it operates
- Tone at the Top statement – the governing body commitment ISO 37301 requires to be explicit and visible
- Three Lines Compliance Framework – who owns compliance in operations, who oversees it and who provides independent assurance
- Compliance Policy and Code of Conduct
- Anti-Bribery Policy and the conflicts of interest position
- The compliance obligations register – legal, regulatory, contractual and voluntary obligations, with the owner and the evidence of compliance for each
- Compliance risk assessment methodology and register, rating obligations by likelihood and consequence of breach
- Compliance function roles, independence and authority
- Competence, training and awareness
- Raising concerns and whistleblowing, investigation and non-compliance handling
- Performance evaluation – compliance monitoring, internal audit, management review and the compliance culture indicators
- A master workbook carrying the registers, RACI, KPIs and implementation roadmap
- Cross-mapping to related standards
ISO 37301:2021 is current and recently reconfirmed
ISO 37301:2021 is the current edition, amended in 2024 to add consideration of climate change, and reconfirmed by ISO in August 2026 – so it is stable with no revision in prospect.
It replaced ISO 19600, which was guidance only. The significant change was making it a requirements standard, and therefore certifiable. That is why organisations adopt it: a certificate demonstrates to regulators, partners and courts that compliance is managed systematically rather than asserted.
The compliance obligations register is where that demonstration begins. An organisation that cannot enumerate its obligations cannot claim to manage them, and a register that lists only the obvious statutes while omitting contractual and licence conditions is incomplete in exactly the way auditors probe.
Who needs compliance obligations register
Regulated organisations needing to show a supervisor that compliance is systematic. Companies operating across jurisdictions with obligations they struggle to enumerate in one place. Organisations following an enforcement action or a near miss. And those holding ISO 37001 for anti-bribery who want the broader compliance system around it.
How the compliance obligations register maps to the framework
ISO 37301 is built on the same management system structure as ISO 9001 and ISO 27001, so context, leadership, competence, internal audit and management review integrate rather than duplicate. What is distinct is the compliance obligations register and the culture indicators – the standard expects you to measure whether compliance behaviour is actually present, not only whether policies exist.
Frequently asked questions
Is ISO 37301 certifiable?
Yes. It is a requirements standard, unlike ISO 19600 which it replaced and which was guidance only.
Which edition is current?
ISO 37301:2021 with the 2024 climate amendment, reconfirmed by ISO in August 2026.
How does it relate to ISO 37001?
ISO 37001 covers anti-bribery specifically; ISO 37301 covers compliance generally. Many organisations hold both and integrate them. See the ISO 37001 Toolkit.
Only 24 documents – is that enough?
Yes, deliberately. A compliance system is judged on the quality of the obligations register and the evidence behind it, not on document count. Padding it makes it harder to maintain.
How many documents are included?
24 editable files – 23 Word documents and a master Excel workbook – plus guidance and a licence file.
Related toolkits
Compliance management connects to several systems. See the ISO 37001 Toolkit for anti-bribery, the ISO 31000 Toolkit for the risk framework, the COSO Toolkit for internal control and the ISO 27001 Toolkit for information security obligations. EU obliged entities should add the EU AMLR toolkit for the anti-money-laundering obligations that apply from July 2027.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your compliance obligations register downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the compliance obligations register are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.