Compliance programme checklist
Ten questions to help organise obligations, evidence, ownership and reviews.
Start with obligations and scope
Identify applicable requirements and the business processes they affect. Assign an owner to each obligation and document how it maps to a control.
Evidence should demonstrate operation
A policy alone does not show that a control is operating. Retain dated approvals, review decisions, control records and remediation evidence.
- Document applicable obligations and the scope of each.
- Assign accountable owners to obligations and controls.
- Map requirements to specific controls and business processes.
- Define evidence, review frequency and retention expectations.
- Assess control design and whether it operates in practice.
- Track exceptions, findings and corrective actions.
- Escalate overdue or significant issues to decision makers.
- Review relevant supplier obligations and assurance evidence.
- Monitor changes to requirements and business activities.
- Report progress, residual gaps and decisions required.
Use this as a starting point.
Adapt the resource to your organisation’s scope, risk methodology, policies and applicable requirements. Examples are fictional and intended for learning.
Created by CyberJA Academy. Free for personal learning and internal use. Do not enter sensitive organisational information into the assessment.