Compliance tracking

What breaks: the obligation register is a spreadsheet somebody maintains and nobody checks, so an obligation that fell due last quarter looks the same as one due next month. The compliance manager spends Monday mornings emailing control owners for statuses that should already be recorded, and the evidence for a requirement is usually still being assembled. What the workflow does: it keeps one register entry per obligation carrying the requirement, its source, a named owner, the due date, the current status, and a link to the evidence. Status is read from the systems that already hold it where possible, and anything not reported is listed as unreported rather than treated as met. Entries inside a warning window are listed daily with the owner and the specific evidence still missing, and anything past its date escalates to the compliance lead with the gap named. When evidence lands it is filed against the entry, so the next review starts from the same place. What a person still approves: the compliance lead decides whether a gap is closed, and the control owner confirms the evidence answers the obligation.