What is compliance management?
Compliance management turns applicable obligations into owned controls, repeatable procedures, evidence, monitoring and a route for exceptions. See a worked QueryChart process and practical steps for applying it.
Compliance management turns applicable obligations into owned controls, repeatable procedures, evidence, monitoring and a route for exceptions.
The short version
- Map obligations: Record the applicable requirement, affected activity, control and accountable owner.
- Operate and evidence: Document the procedure and retain proof that the control ran when required.
- Monitor and respond: Review results, handle exceptions and deficiencies, and update controls after changes.
What is compliance management in practice
A list of regulations or policy PDFs is not a management process. A team needs to know which obligation applies, who owns its control, what evidence shows operation, and how a failure or exception is assessed.
Maintain an obligation-to-control map, assign accountable owners, document procedures at the point of work, monitor results and resolve exceptions. The example shows why a temporary exception needs an impact assessment, compensating measures and an expiry date.
See the compliance policy exception process workflow
Step through the decisions behind what is compliance management.
Map obligations
An exception request names the policy clause, scope, reason and end date rather than asking for an informal waiver.
Operate and evidence
A possible external-duty conflict is rejected; otherwise the owner assesses the control and compensating measures.
Monitor and respond
Approved temporary measures are monitored to expiry and remediation restores the normal control.
How it works
Map obligations
Record the applicable requirement, affected activity, control and accountable owner.
Operate and evidence
Document the procedure and retain proof that the control ran when required.
Monitor and respond
Review results, handle exceptions and deficiencies, and update controls after changes.
Mistakes to avoid
Missing the decision record
Keep the actor, decision and effective state alongside the output. A list of regulations or policy PDFs is not a management process. A team needs to know which obligation applies, who owns its control, what evidence shows operation, and how a failure or exception is assessed.
Open the worked process
Use the linked compliance policy exception process template to adapt the workflow to your team.
Frequently asked questions
Does software make an organization compliant?
No. People must define applicable obligations, operate controls and retain evidence.
What is a compliance control?
A specific activity designed to meet or test an obligation or internal policy requirement.
Why track exceptions?
A time-limited departure can change risk and needs authorization, monitoring and an end state.