Almost every board that says it was caught off guard by an obligation had already had the underlying European directive on its radar somewhere. What was missing was not the knowledge that something was coming, but the visibility into what the national implementation made of it. A directive is transposed differently in every country: different thresholds, different deadlines, different bodies that supervise compliance. Anyone who only follows the European text sees the outlines but not the sharp edges that vary by country.
That is the common thread. National headings are structurally underestimated, because attention goes to the European level and the assumption is that the national translation will be a mere formality. That translation often is not. The way in which you keep track of national headings without ending up in a jungle of subscriptions determines in practice whether an obligation comes into view on time or only becomes visible when the first question from a supervisor arrives.
A second explanation for the surprise is closer to home. There is often a policy document, an intention, a paragraph in the annual report. There is not always a practice that meets it at the moment it counts. It is worth reading what the difference is between policy and practice and why that difference is exactly where a control gets stuck. Policy describes an intention; a control demonstrates that intention actually happens, repeatedly and with evidence.
That difference also explains why an organization often feels safer than it is. There is a document, a decision was once made, and that is taken to mean the topic is settled. An obligation that was fulfilled once and not kept up afterward is, in practice, an obligation that is not fulfilled at the moment it is asked about.
A third reason for surprise is an unclear owner. An obligation that does not specifically belong to anyone is followed a little by everyone and completely by no one. By the time it becomes clear that a deadline was missed or a report was not complete, the question of who should have flagged this is just as unanswered as the question itself. It is therefore relevant to determine who should be the owner of an obligation before that question becomes urgent, not after.
An owner without evidence, incidentally, is just as vulnerable as evidence without an owner. Both are needed, and both must match what an external party actually expects to see.
A final factor is movement. Obligation registers are not documents you draw up once and then leave alone. Legislation changes, national implementations are adjusted, thresholds are revised. How often that happens and what it means for the way a register is maintained is described on the page about how often an obligation register changes. A register that was correct a year ago is not automatically a register that is still correct today.
It is more credible for a board to know what a method does not solve than to hear that everything has been covered. This way of working establishes which obligations apply, who is the owner, what evidence is needed and which control belongs to it. It does not tell in advance exactly which article, which threshold or which deadline applies; that depends on the exact situation and on the current legal text, which is found at the source itself, not in a summary that may be outdated. It also does not guarantee approval by a supervisor or auditor. What it does do is provide the structure with which a board can show that it has oversight and that it maintains that oversight as well.
That is a different kind of result than a report. A report describes a situation at a moment in time; a structure that links ownership, evidence and control together remains usable as the situation changes. Why that difference matters precisely in an assurance process is explained on the page about what an assurance statement requires of your file, and why a compliance check is something different from a report that ends up as a standalone document in a drawer.
Once it is clear which obligations apply, who is the owner and what evidence is needed, another question follows naturally: who does the maintenance needed to keep this up to date, and how much of that work is repetitive enough to organize differently. The work scan from FTE TO AI calculates per task which part of the work can be taken over by AI, and is therefore a logical next step once the obligation register is in place: not to replace the control, but to determine what is structurally involved in keeping that control up.
Vraag maar welke verplichting op u van toepassing is, en waaraan u dat kunt aantonen.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.