Managing Compliance Obligations: How to Build and Keep a Legal Register

Every ISO management system rests on one quiet assumption: that the business knows which laws apply to it and is meeting them. Most businesses do know the big ones. The trouble starts with the rest: the regulation under the Act, the code of practice, the licence condition, the clause in a customer contract. That is what a compliance obligations register, often called a legal register, is for.

Short answer

A legal register lists the legal and other requirements that apply to the business, says in plain English what each one requires, and shows how the business meets it, who owns it and where the evidence is. It is reviewed when things change, and compliance against it is evaluated on a schedule. ISO 14001 and ISO 45001 require that evaluation explicitly; ISO 9001 and ISO 27001 expect the same knowledge.

What the standards require

“Other requirements” matters as much as legislation. It covers codes of practice, licence and permit conditions, customer and contract requirements, industry codes, and any voluntary commitments the business has signed up to.

What goes in a legal register

• The obligation, named precisely: the Act, regulation, code of practice, licence or contract, with the section where it matters.
• Jurisdiction: Commonwealth, state or local, because the same activity can carry different duties in different states.
• Where it applies: the sites, activities, products or roles affected.
• What it requires, in plain English.
• How the business complies: the procedure, control or record that meets the requirement.
• Owner: the person responsible for keeping it met.
• Evidence: where the proof lives.
• Review and evaluation: the date last reviewed, the date compliance was last evaluated, and the result.

The column that does the work is “how the business complies”. A register that lists Acts without linking each obligation to a control is a reading list, not a management tool.

How to build one

1. Map the activities. List what the business does, where, and with what: sites, processes, plant, chemicals, data, products and services.
2. Identify the obligations. Work from the activities to the legislation, not the other way round. Include regulations and codes of practice under each Act, and licence, permit and contract conditions.
3. Translate them. Write each obligation as a plain-English requirement someone on the floor would recognise.
4. Link the controls. Point each obligation at the procedure, inspection, training or record that meets it, and fill the gaps where nothing does.
5. Assign owners and evidence. Every line has a person and a place to find the proof.
6. Set the review triggers. Decide how changes will be picked up and how often compliance will be evaluated.

Keeping it current

Laws change constantly, so the register is only as good as the way changes reach it. Most businesses use a mix of:

• Free official sources: the Federal Register of Legislation, state legislation websites, and email updates from the regulators that matter to the business, such as the state work health and safety regulator and environment protection authority.
• A commercial legislative alert service, which suits businesses with many sites, states or permits.
• Industry associations and professional bodies, which often flag changes early and explain what they mean in practice.
• Customer and contract reviews, because contract requirements change at renewal, not when a law changes.

Whatever the source, the change has to land somewhere: a named person who reviews it, updates the register and the affected procedures, and records that it was done. Changes and the state of compliance are inputs to management review.

Evaluating compliance

Evaluation is the check that obligations are actually being met. It can be built into the internal audit programme, into scheduled inspections, or run as a separate review, as long as it happens at a planned frequency and the result is recorded. Higher-risk obligations deserve more frequent checks. Any shortfall goes through the same correction and corrective action process as any other nonconformity.

What auditors find most often

• A register of Act titles with no obligations, controls or owners against them.
• Codes of practice, licence conditions or contract requirements missing entirely.
• No record of when the register was last reviewed, or of what changed.
• Evaluation of compliance claimed but not recorded, or never done.
• A register built for one state applied to sites in another.

Codes of practice deserve their own attention

In work health and safety, approved codes of practice are a practical guide to meeting legal duties, and in some states they now carry more weight. From 1 July 2026, NSW made compliance with approved codes of practice enforceable unless a business can show an equivalent or better standard. Our safety codes of practice guide includes a free Codes of Practice Compliance Register for tracking which codes apply and how each is met.

Spreadsheet or system?

For most small and mid-sized businesses a well-structured spreadsheet or a Microsoft List does the job, provided it has owners, review dates and evidence links, and someone actually reviews it. Larger or multi-state organisations often move to a dedicated platform. We look at the trade-offs in compliance platforms and what they mean for your certification.

How Streamline helps

We build compliance obligation registers as part of ISO 9001, ISO 14001, ISO 45001 and ISO 27001 systems, linked to the procedures and records that prove compliance, and we evaluate compliance as part of the internal audit. We can build it with you or mentor your team to build and maintain it. Talk to us about your compliance obligations.

Frequently asked questions

Is a legal register mandatory?

ISO 14001 and ISO 45001 require organisations to determine their compliance obligations, keep documented information on them and evaluate compliance. They do not prescribe a register, but a register is the simplest way to show an auditor all three. ISO 9001 and ISO 27001 expect the same knowledge without asking for a separate document.

How often should a legal register be reviewed?

Whenever something changes: new legislation, a new site, a new activity or a new customer contract. On top of that, a full review at least once a year, usually feeding into management review, is a sensible minimum.

What is the difference between a legal register and evaluation of compliance?

The register lists the obligations and how they are met. Evaluation of compliance is the periodic check that the business is actually meeting them, with a record of the result and any action taken.

Speak with an experienced ISO auditor

If you’d like help building compliance management into your management system, you’ll work directly with an experienced ISO auditor and our systems are built to certify first time. Email hello@streamline.business, call Brisbane 07 3667 8280, Sydney 02 8315 7780 or Melbourne 03 9034 3990, or get in touch here. One of our consultants will respond within one business day.