Obligations
Track the requirements you must meet, assess compliance and record attestations.
8 min read9 sectionsAll roles (deleting an obligation is owners and admins only)
The Obligations register lists the requirements your organisation must meet — laws, regulations, contracts, standards and internal rules. Use it to record who owns each one, when it is next due, how compliant you are, and which controls support it.
Open Obligations from the sidebar to see every obligation you have access to.
Each row shows ID, Title/Obligation, Description, Category, Reference, Source, Owner, Classification, Shared, Frequency, Next Due and Controls, followed by the row actions View, Status and Propose Update. The ID and title stay pinned on the left when you scroll sideways.
The ID cell is tinted by compliance
- Compliant
Green.
- Partially Compliant
Amber.
- Not Compliant
Red.
- Not Assessed
Grey. Also used when no compliance value is recorded.
A Next Due date shows in red when it has passed and the obligation is not Compliant. Shared shows a chip when the obligation is also visible to other organisational units. The Controls badge counts linked controls — click it to open the Controls register filtered to those controls.
Search
Matches title, ID, category and source.
All units
Narrows to one organisational unit. Shown when your organisation has more than one unit.
All statuses
Filters by compliance status.
All frequencies
Lists only the frequencies your obligations actually use.
Sort
Sort: Next due (default), Sort: Title or Sort: Compliance.
Category buttons
Buttons above the table narrow the list to one category. Click Categories in the breadcrumb to go back.
New obligations are proposed first and appear in the register once an owner or admin approves them.
- 1
Click New Obligation
It sits top right of the register. You can also click New in the top bar and choose Obligation from the type buttons at the top of the form.
- 2
Fill in the form
See Obligation fields. The AI Assistant panel beside the form can help you draft it.
- 3
Click Submit (propose)
Then confirm with Submit to Queue. You are taken to the new proposal.
- 4
Wait for approval
An owner or admin reviews it on Proposals. Nothing is saved to the register until it is approved.
The fields on the create form, in the order they appear.
- Title
A short name for the requirement, e.g. Annual AML reporting requirement.
- Organisational Unit
The unit that owns the obligation. Defaults to your root unit.
- Also visible to
Other units that can view and link to the obligation. Only owners and admins can set it; only the owning unit can edit the record.
- Source
The kind of requirement: Regulatory, Legislative, Industry Code or Standard, Contractual, Internal Policy or Procedure, or Other. Defaults to Regulatory.
- Reference
Free text naming the specific instrument or clause, e.g. SOC 2 CC6.1.
- Description
What the obligation requires.
- Compliance
Your current assessment. Defaults to Not Assessed. See Compliance status.
- Classification
Public, Confidential (visible only to people with Confidential access) or Highly sensitive (visible only to the people you list under Restricted to).
- Owner
The person accountable for the obligation.
- Frequency
How often it recurs: Daily through Every 3 Years, Ongoing or As Required. Starts at Not set.
- Due Date
When it is next due. Shown as Next Due in the register.
- Obligation Category
A primary and optional secondary category from your risk taxonomy — the same tree risks use.
- Linked Controls
Controls that support this obligation, each with its own effectiveness rating. See Linked controls.
- Linked Risks, Policies, Treatment Plans, Evidence, Incidents
Other records this obligation relates to.
- Additional Information
Optional notes for the reviewer.
Compliance is the only state an obligation has — there is no separate workflow status or severity.
- Not Assessed
Assessment not yet performed, or the last one has lapsed.
- Compliant
All requirements met.
- Partially Compliant
Some requirements met. You can also record a Compliance %.
- Not Compliant
Requirements not met.
The Status button is how you record an assessment of an obligation.
- 1
Click Status on the obligation's row
The Update Compliance Status dialog shows the obligation and its current status.
- 2
Choose a New Status
You can choose the current status to confirm that nothing has changed.
- 3
Enter a Compliance % (Partially Compliant only)
A number from 0 to 100 for how much of the obligation is met. Leave it blank to clear it. Any other status clears the percentage.
- 4
Write the Justification / Notes
Required. Explain why this status is right — approvers read it.
- 5
Click Submit for Review
This creates a proposal and takes you to it.
When the proposal is approved, the obligation takes the status you chose and the update is recorded as an attestation: Last Attested is set, an entry is added to the obligation's Attestation History (the outcome, the date, the approver and your notes, marked self-approved if you approved it yourself), and the next due date moves forward. See Due dates and attestation.
An assessment holds until the obligation's next due date.
When a Status update is approved, Next Due moves to one Obligation Review Cycle after the date you submitted it — 365 days unless your organisation changed the cycle. Owners and admins can change the cycle on the Compliance Configuration page. Otherwise, the due date only changes when someone proposes a new Due Date.
Each control linked to an obligation carries its own effectiveness rating for that obligation.
- 1
Open the obligation's form
Use New Obligation, or Propose Update on an existing one.
- 2
Click Add controls...
Search by control ID or title and pick one. Repeat with Add another control....
- 3
Rate each control
Choose a rating from your organisation's effectiveness scale in the drop-down beside the control.
- 4
Submit the proposal
The links and ratings take effect when it is approved.
A control's rating here is independent of its rating against any risk — the same control can be Effective for one obligation and Ineffective for a risk. See the Controls guide.
Click View on a row to open the obligation's own page.
Compliance Information
Compliance, Business Unit, Also visible to, Restricted to, Reference and Categories.
Review Schedule
Frequency, Next Due and Last Attested.
Attestation History
Every approved Status update, newest first.
Linked records
Controls (with each rating), Risks, Policies, Treatment Plans, Evidence and Incidents. Click a chip to open the record.
The action row has ← Back to Obligations, Propose Update and, for owners and admins, Delete. On an obligation shared into your unit from another unit, Make your own also appears: it opens the create form pre-filled as a copy for your unit, with compliance reset to Not Assessed and no links carried over.
Both exports include only the rows your current search and filters show.
Export CSV
A spreadsheet with compliance, source, reference, owner, frequency, due date, primary and secondary category, organisational unit, Raised By and each linked record as KEY — Title. A rated linked control also shows its rating.
Download PDF
An Obligations Register document, A4 landscape: a summary table, then one block per obligation. If the print dialog previews portrait, set Layout to Landscape and keep Margins at Default. Allow pop-ups for the site if nothing opens.