A 350-line obligations register where everything is high risk
Helio Systems is a 600-person SaaS provider serving customers in the EU and the United States. Its legal team has compiled a compliance obligations register with 350 entries drawn from privacy, employment, export-control, tax and sector rules. Every obligation is rated high risk because, in the legal team's words, 'you cannot be non-compliant.' The assessment was performed by one junior lawyer without input from engineering, sales or operations. There are no defined risk criteria, no treatment plans and no link to business processes. Compliance objectives are '100% compliance' and 'zero fines.' No objective has an owner, deadline or measure. The training budget has been cut by 30%. A new compliance manager has 12 months to prepare for certification and a skeptical CEO who wants a one-page plan. The legal team insists the register is complete and should not be reopened.
1. Evaluate whether Helio's obligations register and risk assessment provide a sound basis for planning a CMS. Distinguish compliance obligations from compliance risk in your answer.
Read the worked answer
A register of obligations is necessary but not sufficient. ISO 37301 planning starts from compliance obligations and then assesses compliance risk: the likelihood and consequences of failing to meet those obligations, considering causes, controls and context. Helio has a legal inventory, not a risk assessment. Rating all 350 items high is effectively no rating; it gives no basis for prioritisation, resource allocation or treatment. The assessment lacks business input, risk criteria, likelihood and impact analysis, and process mapping. Objectives of '100% compliance' and 'zero fines' are aspirational and are not managed through specific, measurable, achievable, relevant and time-bound targets. A sound basis requires validation of obligations with process owners, a documented methodology, assessment of inherent and residual risk, and identification of controls and treatment actions. The register should be reopened for validation, not discarded.
2. What should the compliance manager do to turn the register and objectives into a risk-based, resourced 12-month plan? Include how to prioritise when everything is currently 'high'.
Read the worked answer
First, confirm scope and context, then rebuild the risk assessment with a cross-functional group. Define risk criteria: impact dimensions such as legal, financial, operational and reputational; likelihood definitions; and a tolerance threshold. Map each material obligation to the process, owner and existing control. Assess inherent risk, test control design, and rate residual risk. Prioritise treatment by residual risk and by the strength of the control environment, not by the label 'high'. Create a 12-month plan with a few measurable objectives, for example: complete risk assessment for the top 20 processes by month 3; close all high residual risks or accept them with CEO approval by month 9; deliver role-based training to high-risk roles by month 6; and test 10 key controls by month 11. Assign owners from the business, not only legal. Reallocate the reduced training budget to high-risk roles and use existing forums. Include internal audit and management review milestones.
3. The CEO asks why the plan cannot simply be the legal team's register with dates added. How should the compliance manager explain the planning logic and what documented information should support it?
Read the worked answer
The register answers 'what rules apply?' The plan must answer 'what could go wrong, how likely and severe is it, what controls reduce it, who owns the action, and how will we know it worked?' Adding dates to a legal register produces activity, not risk treatment. The compliance manager should explain that the plan links obligations to processes and risks, sets prioritisation criteria, resources the highest residual risks, and defines measures. Documented information should include: scope and context summary; risk assessment methodology and criteria; obligations register with process mapping; risk assessment results; risk treatment plan with owners, dates and resources; compliance objectives and plans; and a monitoring and reporting schedule. The CEO's one-page plan can be a summary dashboard, but it must sit on this evidence.