The programme needs a list of what the organisation must follow, separate from the controls that describe what it does. The legal requirements register is that list: each law, regulation, or contract, specific enough that someone else can find the original text, and an owner who keeps the response current.
What the register shows
The counts show how many obligations are on the register, how many are active, and how many are regulatory or contractual. A control test can keep an image of the register as it stood when the test was run, so the list can be used as evidence.
- Legal, regulatory, or contractual. The kind of obligation, so a statute is not mixed up with a customer contract.
- Source. The law, regulator, contract, or clause.
- Owner and status. Who keeps it current, and whether it is still being captured, still applies, or no longer applies.
When you need to change it
The legal requirements register and requirement status describe the fields and the lifecycle.