What Is a Compliance Management System? A Plain-English Guide
A compliance management system is how an organisation knows what rules apply to it and proves it follows them. Here is what goes into one, how it changes with size, and where software helps.
In short
A compliance management system (CMS) is the combination of people, processes and records an organisation uses to identify the laws, regulations and commitments that apply to it, put controls in place to meet them, check those controls work, fix problems, and show evidence to regulators, auditors or customers. Software can support parts of it, but a CMS is not a product you buy.
Related guides: how to charter a compliance committee that actually drives action and how to conduct an internal compliance audit.
What a compliance management system actually is
The word “system” causes most of the confusion. It means a way of working, the same way a quality system or a safety system does, not a piece of software.
Every organisation that follows rules already has some kind of compliance system, even if it is a manager’s memory and a folder of signed forms. A compliance management system is what you have when that work is deliberate: someone owns it, the obligations are written down, there is a repeatable way to meet them, and there is evidence that you did.
A practical test is whether you could answer three questions quickly and with documents rather than reassurance: What rules apply to us? How do we make sure we follow them? How do we know it is working?
There is an international standard for this. ISO 37301:2021, Compliance management systems — Requirements with guidance for use, covers establishing, running, evaluating and improving a CMS. Few small organisations certify against it, but it is a useful reference.
The seven core components
Different frameworks slice this differently, but nearly all of them cover the same ground.
1. Obligations inventory
A list of the laws, regulations, licence conditions, contracts and internal commitments that apply, who owns each one, and which locations or roles it affects.
2. Policies and procedures
The written rules that turn each obligation into something people do: what is required, who does it, and how. Policies set the rule; procedures explain the steps.
3. Training and communication
Making sure the right people have read the rules, understand them, and hear about changes. Includes onboarding and a record of who has acknowledged what.
4. Monitoring and testing
Checking that controls are followed in practice: spot checks, walk-throughs, internal audits, and watching for changes in the rules themselves.
5. Issue handling
A route for reporting concerns and complaints, investigating them, fixing the root cause, and confirming the fix held. Includes deciding when to escalate.
6. Reporting
Regular, honest information to leadership or the board: what is on track, what is overdue, what went wrong and what was done. Also the evidence you hand to auditors.
7. Review and improvement
Stepping back at set intervals to ask whether the system still fits the business: new locations, new rules, repeat issues, and whether oversight is working.
Underneath all seven: ownership
Someone accountable for the system as a whole, with access to leadership. In larger organisations that is often backed by a compliance committee.
How small and larger organisations run one
The components stay the same as you grow. What changes is how formal each one needs to be, and how many people share the work.
Single site, small team
One owner, light records
An owner or operations manager holds the obligations list, keeps policies in one shared place, gets new hires to sign them, and reviews everything once a year. That can be enough if it is written down.
Several locations
Local managers, central rules
Rules start to vary by state or city. Someone central owns the policies; location managers make sure their staff have read the right ones. Tracking who has acknowledged what becomes hard by hand.
Larger or regulated
Dedicated function, formal oversight
A compliance lead or team, a committee that meets on a schedule, a risk-based internal audit plan, a formal speak-up channel, and regular reports to leadership or the board.
Do not copy a bank’s system into a ten-person business. A CMS should be proportionate to your risks. A short, current, actually-used set of records beats a large framework nobody maintains.
Where policy management software fits, and where it doesn’t
Software is good at the repetitive, evidence-heavy parts of a CMS: keeping one current version of each document, getting it in front of the right people, recording who read it and when, and producing reports. It cannot decide which obligations apply to you, judge whether a control is adequate, investigate a complaint, or give leadership the attention a compliance programme needs.
To be clear about our own product: policy management software such as PolicyTrak covers the policies-and-procedures and communication components well, and supports reporting on them. Law Watch handles the regulatory-change side of monitoring: it identifies agencies relevant to your locations and alerts you to changes that may affect your policies. PolicyTrak is still not a complete CMS. Your obligations inventory, issue handling, audit programme and committee work will live elsewhere, in other tools, spreadsheets or meeting records.
Here is what PolicyTrak does for the policy part:
Policy management
Draft from templates or with AI help (drafts still need human review), route through approval chains, and keep a numbered version history with author and timestamp. Earlier versions can be compared and restored.
Document acknowledgment
Assign policies by location and jurisdiction, deliver in the portal or by email, and record each acknowledgment with date and time. Reminders go out at intervals you set, with escalation to managers.
Reports and analytics
Filter by location, policy category and date range, use templates such as past-due acknowledgments or policy changes over a period, schedule reports, and export to Excel, CSV or PDF.
NotePolicyTrak manages policies, procedures and acknowledgments. It does not hold your obligations inventory, investigate issues or run your audit programme.
How to start a compliance management system
Do not start by buying software or writing a manual. Start with what you are obliged to do.
- 1
Name an owner
One person accountable for the system, with time set aside and a direct line to leadership. Without this, every later step stalls.
- 2
List your obligations
Start with what you already know: licences, permits, employment rules, health and safety, data, and key contracts. Note the owner and the locations affected. Ask counsel to check the list for gaps.
- 3
Map each obligation to a policy or procedure
Where nothing covers an obligation, that is your first writing task. Where several old documents cover it, consolidate them.
- 4
Get the rules to the people who follow them
Distribute by role and location, record acknowledgment, and build new-hire onboarding around the same set.
- 5
Set up a way to raise and fix issues
A simple reporting route, a log of what was raised, who looked at it and what changed as a result.
- 6
Check, report and review on a calendar
Schedule spot checks or an internal audit, a short regular report to leadership, and an annual review of the whole system.
Keep the evidence as you go. Regulators and auditors generally want to see that the system operates, not just that it exists. Dated approvals, acknowledgments, audit notes and meeting minutes are what show that.
Put the Policy Part of Your CMS in Order
Versioned policies, approval chains, dated acknowledgments and exportable reports in one place. Sign up and see plans without booking a call.
