Your compliance register template is ready to download in Excel, Google Sheets, or PDF format. Open it, map your ten to fifteen highest-risk obligations into the core columns, assign an owner to each row, and set your first review date. That single action gives you an audit-ready, centralised record of every legal, regulatory, contractual, and voluntary obligation your business carries.
A compliance register is the controlled document that sits at the heart of ISO 9001, ISO 14001, and ISO 45001 management systems. It is not just a list of rules. Done properly, it links each obligation to the evidence that proves you are meeting it, so when an auditor walks in, you are not scrambling through folders.
Key takeaways
A compliance register is only as useful as the evidence linked to it. Start with your highest-risk obligations, assign a named owner to every row, and set review dates before you expand the register further.
| Point | Details |
|---|---|
| Start with a template | Download an Excel or Google Sheets template and populate your ten to fifteen highest-risk obligations first. |
| Assign a named owner | Every row needs a specific person responsible, not a team or department. |
| Link direct evidence | Point the Evidence column to the exact document, not a folder, to cut audit preparation time. |
| Set a review cadence | Quarterly for high-risk items, annual full review as a minimum; back every date with a calendar task. |
| Ask Hayley automates the cadence | Ask Hayley creates tasks, sends voice and SMS reminders, and integrates with Xero and AroFlo to reduce manual upkeep. |
Table of Contents
- What columns should your compliance register template include?
- Australian examples: which obligations and regulators should you check?
- How do you build and maintain a compliance register that stays current?
- Which compliance register template suits your business?
- Is your register ready for an audit?
- Worked example: a completed register row for a construction business
- How automation and Ask Hayley workflows reduce register maintenance time
- What actually matters most in a compliance register
- Ask Hayley keeps your compliance register current without the admin burden
- Sources
What columns should your compliance register template include?
The structure below reflects the standard fields that support audit evidence under ISO 9001, ISO 14001, and ISO 45001. Every column earns its place.
| Column | Purpose |
|---|---|
| Obligation ID | Unique reference for tracking and cross-referencing |
| Obligation title / summary | Plain-language description of the requirement |
| Source / citation | The Act, regulation, standard, or contract clause |
| Applicable clauses | Specific section numbers within the source |
| Jurisdiction | Federal, state, or territory (e.g. NSW, QLD) |
| Type | Legal / regulatory / contractual / voluntary |
| Controls or required actions | What your business does to meet the obligation |
| Responsible owner / role | Named person or role accountable for compliance |
| Monitoring frequency | How often compliance is checked |
| Compliance status | Current status: compliant / non-compliant / in progress |
| Evidence link(s) | Direct link to the SOP, test report, or signed form |
| Last reviewed / next review date | When it was last checked and when it is due again |
| Risk or priority | High / medium / low, based on consequence of failure |
The ISO 14001:2015 compliance register template uses this same column set for environmental obligations, with the addition of a “departments responsible” field for larger teams. Adapt that for your context.
Sample completed row
Pro Tip: Link the Evidence column directly to the specific SOP, signed checklist, or test report, not just a folder name. “See HR folder” tells an auditor nothing. A direct file path or shared-drive URL cuts your pre-audit preparation time significantly.
Australian examples: which obligations and regulators should you check?
Australian SMEs carry obligations across several layers of law. The federal and state split catches many small businesses off guard, particularly in construction compliance tracking and work health and safety.
Common obligation types for Australian SMEs
- Work health and safety: duties under the Work Health and Safety Act 2011 (Cth) and equivalent state Acts, including risk assessments, induction records, and plant registration
- Environmental: EPA permits, waste disposal requirements, and stormwater management under state environment legislation
- Planning and permits: development approvals, building permits, and occupation certificates from local councils
- Fair Work and employment: minimum wage compliance, award obligations, and record-keeping under the Fair Work Act 2009 (Cth)
- Licences and registrations: contractor licences, electrical licences, plumbing licences, and vehicle registrations
- Industry codes: voluntary codes of practice, OECD responsible business conduct guidelines for businesses with supply-chain exposure, and industry association requirements
Key Australian regulators to check
- Safe Work Australia: national WHS policy, model codes of practice, and guidance material; applies to all industries
- State WHS regulators: SafeWork NSW, WorkSafe Victoria, Workplace Health and Safety Queensland, and equivalents in other states; these are the enforcement bodies
- Aged Care Quality and Safety Commission: for aged-care businesses, the Commission expects active management of compliance obligations with demonstrable evidence, not just a formatted document
- State EPA agencies: environmental permits and monitoring obligations vary significantly by state
- Fair Work Ombudsman: employment record-keeping, pay rates, and award compliance
For businesses operating across multiple states, segment your register by jurisdiction. A Queensland electrician picking up work in Victoria faces different licensing requirements, and mixing those rows creates confusion fast.
How do you build and maintain a compliance register that stays current?
A three-phase approach keeps the process manageable for a small team.
-
Populate. Start with your ten to fifteen highest-risk obligations. Pull from the regulators listed above, your insurance register template, and any contracts with compliance clauses. Fill every column for each row before moving to the next obligation. Partial rows create gaps that look worse in an audit than a shorter, complete register.
-
Link evidence. For each obligation, locate the actual evidence document and paste the direct link or file path into the Evidence column. This is the step most businesses skip. Without it, the register is a list, not an audit tool.
-
Operationalise ongoing reviews. Set calendar tasks for every review date in the register. High-risk obligations warrant a quarterly check. A full register review once a year is the minimum for most SMEs. Assign a named person to own each row, not just a team or department.
Roles and triggers
Ownership works best when it is specific. One person owns the register overall (typically the business owner, operations manager, or compliance officer). Individual row owners are the people closest to the obligation, such as the site supervisor for WHS items or the accounts manager for Fair Work record-keeping.
Update triggers to watch for include legislative amendments, permit expiry dates, incident findings, contract renewals, and new project scopes. Subscribe to Safe Work Australia updates and your state regulator’s newsletter to catch legislative changes early.
Initial population of a fifteen-obligation register typically takes four to eight hours for a small business. Ongoing maintenance, once the structure is in place, runs to roughly one to two hours per quarter for most SMEs.
Pro Tip: Manual registers suffer from “silent failure” when review dates pass unnoticed. Create a recurring calendar task for every review date in the register, and add a change-log column to record what was updated and when. Version history in a shared platform like Google Sheets or SharePoint provides the same protection automatically.
Which compliance register template suits your business?
Three variants cover most Australian SME needs.
-
Compact SME general template: covers all obligation types in a single sheet with the core thirteen columns. Best for tradies, sole traders, and businesses with fewer than twenty obligations. The IBA legislative compliance register is a practical Australian government example you can adapt directly.
-
Legislative / obligation-focused register: adds detailed citation fields (Act name, section, commencement date, amendment history) and a separate obligations summary column. Suited to businesses in regulated industries such as aged care, financial services, or food manufacturing where the source text matters as much as the obligation itself.
-
HSE / environment-specific register: built around ISO 14001 and ISO 45001 clause requirements, with columns for monitoring frequency, permit numbers, and environmental targets. Suited to construction businesses, manufacturers, and any operation holding an EPA permit.
Spreadsheet vs purpose-built tool
Starting with a spreadsheet (Excel or Google Sheets) is the right call for most SMEs. It is free, portable, and familiar. The limitation is that spreadsheets lack automated change monitoring, so a missed review date goes unnoticed unless you have calendar tasks in place.
A purpose-built compliance or GRC platform adds automated alerts, version control, and workflow triggers. That investment makes sense when you are managing more than fifty obligations, operating across multiple jurisdictions, or preparing for a third-party ISO audit. For most tradies and small service businesses, a well-maintained spreadsheet with calendar reminders does the job.
After downloading: assign an owner, run a one-week pilot with five obligations, and check that every evidence link resolves correctly before expanding to the full register.
Is your register ready for an audit?
Use this checklist before any internal review or external audit.
- All obligations mapped with a source citation and applicable clause
- Every row has a named responsible owner, not just a team
- Evidence links are current and resolve to the actual document
- Review dates are set and not overdue
- Outstanding actions or non-conformances are logged with a target close date
- The register has a version number or last-updated date visible on the document
Auditors commonly ask three things: show me the obligation, show me the control, and show me the evidence. Your register should answer all three without you having to open a second document.
The Aged Care Quality and Safety Commission makes the point clearly: regulators care about accurate content and demonstrable evidence, not the format of the register. A tidy spreadsheet with real evidence links outperforms a polished PDF with no supporting documents.
In the Australian context, an inaccurate or incomplete compliance register carries real consequences. Regulators can treat gaps as evidence of systemic non-compliance rather than administrative oversight, which affects penalty assessments and licence decisions.
Pro Tip: Run a spot check on five random rows two weeks before any scheduled audit. Confirm the evidence link resolves, the review date is current, and the responsible owner is still in that role. Small gaps found early are easy to close; gaps found by an auditor are not.
Worked example: a completed register row for a construction business
Here is one audit-ready row for a common construction compliance obligation, showing how each field links to evidence.
Walking through this row: The Source column cites the exact Act and section so an auditor can verify the obligation without asking you. The Controls column describes the physical action taken, not just the policy. The Evidence link goes directly to the inspection log spreadsheet, which contains dated entries signed by the site supervisor. The next review date is set three months out, consistent with the high-risk rating. This is what ISO clause requirements look like in practice for an environmental obligation.
How automation and Ask Hayley workflows reduce register maintenance time
The biggest compliance risk for a small trade business is not a missing obligation. It is a known obligation that slips through because no one noticed the review date had passed.
Automation turns triggers into actions before that happens.
- Permit or licence expiry alert: a calendar rule fires thirty days before the expiry date, creating a task automatically and notifying the responsible owner
- Ask Hayley voice workflow: the owner receives a voice or SMS prompt from Ask Hayley, confirms the action is underway, and the task is logged against the register row
- Evidence linking: once the renewal document is received, it is attached to the task and the evidence link in the register is updated, keeping the audit trail intact
Ask Hayley’s compliance and task management features integrate with Xero and AroFlo, so financial and job-management data can feed directly into compliance workflows without double-handling.
Where human review is still required: legal interpretation of new legislation, non-routine obligations that fall outside your standard categories, and any obligation where the consequence of error is significant. Automation handles the cadence; your team handles the judgement calls.
What actually matters most in a compliance register
Most businesses spend too long trying to build a perfect register before they have a working one. The better approach is to start with your highest-risk obligations, get those rows complete with real evidence links, and treat everything else as a second pass.
A register with fifteen complete, evidenced rows is more useful on audit day than a register with sixty rows and no evidence attached. Completeness is a goal you work toward over time. Accuracy and evidence are non-negotiable from day one.
The trade-off is real: attempting full coverage immediately usually means shallow coverage everywhere. Start small, build the habit of linking evidence as you go, and the register becomes a living system rather than a document you update once a year and hope for the best.
Ask Hayley keeps your compliance register current without the admin burden
Keeping a compliance register current is where most small businesses struggle. The template is straightforward. The maintenance is where things slip.
Ask Hayley’s safety and compliance documentation services give Australian tradies and small service businesses a practical shortcut. The team can build your initial register, map your obligations to the right regulators and evidence sources, and set up the review cadence so nothing falls through. On the platform side, Ask Hayley creates calendar-driven tasks, sends voice and SMS reminders to obligation owners, and links directly to Xero and AroFlo so your compliance and job data stay connected.
Book a free discovery call at Askhayley to get your register started with professional support.
Sources
- Iso
- Topic guide resource: Compliance Register Example | Aged Care Quality and Safety Commission
- Legislative Compliance Register
- Mneguidelines
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
