If there’s one document that makes people nervous during an ISO 14001 audit, it’s the compliance-obligations register. I’ve seen teams freeze when the auditor asks, “How do you know you’re compliant with environmental laws and other requirements?”
And honestly, it’s understandable. Environmental legislation changes. New permits appear. Industry expectations evolve. What was compliant two years ago might not be enough today.
But here’s the good news: with the right structure, this register becomes a lot easier to manage — and it becomes more than an audit requirement. It becomes a tool that keeps you legally protected, aligned with stakeholders, and responsive to environmental risk.
In this guide, I’ll walk you through how to structure your register, what to include, how to link it to real evidence, and how to keep it updated without drowning in paperwork.
By the time you finish, you’ll have a clear framework you can put into practice — not just theory.
Identifying Applicable Legal and Other Requirements — Start With What Applies to You
Most organisations overthink this step. They start with a long global list of laws and standards, and then spend weeks deleting irrelevant entries. A better approach is starting with what actually affects your activities.
Here’s what typically belongs in the register:
Laws and regulations (local, national, and international, if applicable)
Environmental permits and licenses
Mandatory reporting obligations
Customer requirements or audit frameworks
Industry-specific rules or compliance codes
Voluntary commitments (ISO standards, corporate pledges, sustainability goals)
A quick example from a past client: They were operating a warehouse with fuel-powered forklifts. The team initially overlooked air emissions reporting because the equipment wasn’t technically “manufacturing machinery.” Adding it to the register prevented a future compliance oversight.
Pro Tip: Group obligations by environmental theme: waste, water, emissions, chemicals, noise, biodiversity, land use. It makes reviewing and updating far easier.
Documenting Compliance Requirements Clearly — Keep It Understandable
Once you’ve identified the obligations, the next step is documenting them in a way that makes sense. The register isn’t meant to be a legal textbook — it’s a reference tool.
Your register should summarise:
The source of the obligation
What it requires
Where it applies
Who is responsible
A simple structure works best. Something like:
| Regulation | Requirement Summary | Applies To | Department Responsible |
A common mistake I see: copying and pasting long paragraphs from legislation. Auditors don’t need legal quotes — they need clarity.
Write it as if you’re explaining it to a new employee on their first day.
Tracking Evidence and Status — What Auditors Actually Look For
This is the part of the register where most findings occur — not because organisations aren’t compliant, but because they can’t show evidence.
Your register should connect each obligation to:
A document or record proving compliance
How often compliance is checked
The current compliance status
Any open actions or deadlines
A real-world example: A logistics company added their wastewater discharge permit to the register, but forgot to reference the annual test report that proved compliance. The auditor wasn’t questioning whether they were compliant — they just needed documented proof.
Once the evidence field was added, the finding disappeared at the follow-up audit.
Pro Tip: Use language like “evidence stored in: /Environmental/Permit/Wastewater2024.pdf” — not “available on file.”
Keeping the Register Updated — Make It Routine, Not a Panic Exercise
A compliance register isn’t a static document — it needs to evolve as the business evolves.
Triggers for updating include:
A new law or regulatory update
New permit or renewal requirement
New equipment, activities, or locations
Environmental incidents or corrective actions
Changes in environmental strategy or commitments
I’ve seen organisations wait until the month before a certification audit to update this — and it always becomes a stressful project.
A better approach?
Schedule updates quarterly and assign one accountable owner.
Shared accountability sounds nice in theory, but in practice it often means no one updates anything.
A recurring review meeting with operations, maintenance, EHS, and management works very well.
Example Register Layout — Simple, Clear, Repeatable
A practical format looks something like this:
| Type of Requirement | Source (Law/Permit/Contract) | Summary | Applicable Process/Area | Evidence File/Record | Frequency of Review | Responsible Person | Status (Compliant/Pending/Overdue) |
Add one guiding statement below the table:
“This register must be kept up-to-date and reviewed at least annually, or earlier if regulatory or operational changes occur.”
Colour-coding works well here — especially if you’re preparing for upcoming audits or renewals.
FAQs — Quick Clarifications That Often Come Up
Q: Do voluntary commitments need to be included in this register? Yes. If you commit to something — even if it’s not legally required — ISO considers it a compliance obligation.
Q: Can this register be digital? Absolutely. Many organisations use spreadsheets, SharePoint, or QMS software — as long as version control exists.
Q: How often should we review this document? Minimum once per year. Best practice: once per quarter.
Conclusion — Make Compliance Manageable, Not Overwhelming
A well-structured compliance obligations register can remove uncertainty, reduce audit findings, and create confidence — not pressure.
From experience, the strongest registers share these qualities:
They’re simple enough to understand quickly
They’re linked to real evidence
They’re updated consistently
They align with environmental risks and legal expectations
Melissa Lavaro is a seasoned ISO consultant and an enthusiastic advocate for quality management standards. With a rich experience in conducting audits and providing consultancy services, Melissa specializes in helping organizations implement and adapt to ISO standards. Her passion for quality management is evident in her hands-on approach and deep understanding of the regulatory frameworks. Melissa’s expertise and energetic commitment make her a sought-after consultant, dedicated to elevating organizational compliance and performance through practical, insightful guidance.
