A compliance risk register is a living list of every statutory obligation your company carries, with a score for how likely each is to fail, how badly it would hurt, who owns it, what control protects it and which indicator warns you early. It is not a compliance calendar, which tells you what is due. It is the document that tells you which due date, licence or contractor is most likely to hurt you first.
Most Indian companies that say they have a risk register actually have a spreadsheet with a column called “risk level” filled in by whoever built it, once. This guide is about making the register itself work: the fields that matter, scoring scales you can defend to an inspector or an auditor, heat maps that show a CFO where to look, and key risk indicators (KRIs) that fire before a notice does. If you want the wider framework around the register, read our compliance management solutions guide and the companion piece on compliance risk management; this article stays with the register.
What a Compliance Risk Register Is, and What It Is Not
The register sits between three documents that people confuse with it.
- Compliance calendar. Lists what is due and when, such as the EPF ECR and ESIC contributions on the 15th, or the CLRA principal employer annual return (Form XXV) by 31 January. It says nothing about which item is most dangerous.
- Audit report. A point-in-time finding. Useful, but stale the week after it is issued. Our compliance risk audit guide covers how to run one; the register is where its findings go to be tracked.
- Compliance checklist. Yes or no per item. It cannot tell a missed internal deadline from a lapsed factory licence.
A register is the only one of the four that ranks. That ranking decides where your Compliance Manager spends Tuesday morning and what your CFO reads on the first of the month.
The 14 Fields Every Row Needs
One row per obligation per location. A row with fewer than these fields cannot be scored defensibly or audited later.
| Field | What to record |
|---|---|
| Obligation | Plain description, e.g. “EPF ECR and challan for Site 2” |
| Act and Code tag | Legacy Act and the Labour Code that now subsumes it |
| Form or filing | The actual form, return or register name |
| Frequency and due date | Monthly 15th, half-yearly, annual, or event-triggered |
| Authority | EPFO, ESIC, state labour department, Factory Inspectorate |
| Location | Site or branch, as registered |
| Risk owner | One named person, not a department |
| Likelihood and impact | Inherent scores, each 1 to 5 |
| Control | What actually stops the failure |
| Control evidence | The artefact proving the control ran, with date |
| Residual score | Scores after credit for evidenced controls |
| Linked KRI | The indicator that warns you early |
| Last reviewed and next review | Two dates, both mandatory |
| Notice history | Any past notice or inspection remark on this row |
Two fields do most of the work and are the ones spreadsheets usually lack. Control evidence (field 10) stops people from scoring a risk low because “we have a process”. Notice history (field 14) is the strongest predictor of the next likelihood score you will assign: a row that drew a notice last year is not a 2.
Scoring Scales Anchored in Indian Statutory Consequences
A 1 to 5 scale only works if each number means one thing to everyone who scores. The anchors below are written for Indian statutory compliance; adjust them to your company, but write your version down.
| Score | Likelihood anchor | Impact anchor |
|---|---|---|
| 1 | Automated control, tested, evidence in last 90 days | Internal correction only |
| 2 | Manual control, two people, evidence on file | Interest or a small late fee |
| 3 | Control depends on one person, or on a single data source | Interest and damages, and a notice to answer |
| 4 | Control exists on paper, one miss in the last 12 months | Prosecution exposure for the occupier, employer or officers |
| 5 | No control, or repeated failures | Licence suspension, stoppage of operations or a due diligence deal-breaker |
Three rules make the scale hold up in practice.
Floor the impact. If the Act carries prosecution exposure for the occupier or employer for that obligation, impact never scores below 4, whatever the money involved. Late EPF remittance attracts interest under Section 7Q at 12% per annum and damages under Section 14B and Para 32A of the EPF Scheme, which since 15 June 2024 is a flat 1% per month of default. The rupee amount can look small on one month of one site. The pattern across sites is what draws an inspector.
Score the exposure, not the effort. Renewing a factory licence is easy work and a catastrophic failure. A tedious monthly register can fail with a minor consequence. Teams that score by effort push every licence to Low.
Never let the owner score alone. Owners under-score, honestly and consistently. Have a second person challenge every row scored 2 or below on any obligation with prosecution exposure.
Inherent and Residual Score: How a Control Earns Credit
Inherent score is the risk before controls. Residual score is what remains after the controls you can prove. The gap between them tells you whether your controls are doing anything.
Take the EPF monthly ECR for a site with 600 employees. Inherent: likelihood 4 (it has been filed late twice in the last year), impact 4 (repeat default draws damages and an inspection), score 16, High. After the company introduces a payroll lock two days before the 15th and a maker-checker review of the ECR file, the residual likelihood falls to 2 and the residual score to 8, Medium.
A practitioner rule that keeps this honest: a control reduces likelihood by a maximum of two points, and only if the evidence field shows it ran in the last 90 days. A control that cannot show an artefact (a signed checker approval, a dated acknowledgement from the portal) earns no credit. If the residual score barely differs from the inherent score across your whole register, your controls are decoration. If it drops on every row, your scoring is generous.
Three Heat Maps Management Will Actually Use
The 5 by 5 grid with dots on it is the heat map everybody draws and few people act on. Three variants do more.
Risk heat map (the standard grid). Plot residual likelihood against impact. Use it for the top 10 rows only. With 100 or more rows, the grid becomes a cluster of overlapping dots that tells nobody anything.
Site-by-act heat map. Rows are your locations, columns are your Acts or obligation groups, and each cell takes the highest residual score of any row in it. This one answers the CFO question “which plant is the problem?” in under ten seconds. Use the maximum, never the average. An average of one Red and nine Greens reads as Green and hides the one cell that will hurt.
| Site (illustrative) | EPF / ESIC | Factories Act | CLRA | S&E / PT / LWF |
|---|---|---|---|---|
| Plant 1, State A | Medium (9) | Low (4) | High (15) | Low (6) |
| Plant 2, State A | Low (6) | Medium (10) | Medium (12) | Low (4) |
| Warehouse, State B | Medium (8) | Low (3) | High (16) | Medium (9) |
| Head office, State C | Low (4) | Low (2) | Low (2) | Medium (8) |
Read the table the way a CFO would: the CLRA column is where the money and the personal exposure sit. Two sites with contractor labour account for both High cells, and the next step is not “improve compliance” but “audit those two contractor files this week”. The vendor and contractor compliance guide explains why the principal employer carries that exposure under the Contract Labour (Regulation and Abolition) Act, 1970.
Trend heat map. The same site-by-act grid for three consecutive months. A cell that drifts from Medium to High across the three months deserves a conversation before it crosses the threshold. Static pictures hide drift.
A Key Risk Indicator Library With Thresholds
A KRI is a number you can read from your own data that moves before the failure does. A good one is leading (it falls or rises before a deadline is missed), measurable from system data without a manual count, and tied to an action. Use amber and red thresholds so owners get a nudge before they get an alarm.
| Risk | KRI | Amber | Red | Action at red |
|---|---|---|---|---|
| EPF and ESIC filing | Days between ECR file approval and the 15th | Under 3 days | Under 1 day | Payroll lead escalates; checker backup assigned |
| Challan payment | Challans paid but proof not archived | Any over 3 days | Any over 7 days | Archive before next cycle opens |
| Licence renewal | Days to nearest licence expiry, per site | Under 60 | Under 30 | Renewal file with Plant HR Head |
| CLRA contractors | Contractors with EPF or ESIC proof overdue | Over 15 days | Over 30 days | Written notice; payment hold review |
| CLRA returns | Contractor data received 30 days before the 31 January Form XXV | Under 90% | Under 70% | Principal employer chases directly |
| Registers | Registers pending checker approval | Over 3 working days | Over 5 working days | Backup checker takes over |
| Notices | Open notices older than the reply window | Any at 50% of window | Any at 80% of window | Escalation Owner and counsel |
| Regulatory change | Notified changes with no owner assigned | Any over 5 days | Any over 10 days | Compliance Manager assigns today |
| Headcount thresholds | Sites within 10% of an applicability threshold | Any | Any within 5% | Pre-register before crossing |
| Score quality | Rows not re-scored in the last 12 months | Over 10% of rows | Over 25% | Full register re-score |
The thresholds above are starting points drawn from how these obligations usually fail; set yours from your own filing history. Cap the library at 10 to 12 indicators. Past that, owners stop reading them. Every KRI must link to a register row (field 12), or it is trivia.
Keeping the Register Alive Through the Labour Codes Transition
The four Labour Codes took effect on 21 November 2025, and detailed Central and State rules are still being notified. For a register this has one practical consequence: the legal basis of many rows is moving even while the filing itself has not changed.
Tag every row with both the legacy Act and the Code that now subsumes it. The EPF Act and the ESI Act map to the Code on Social Security, 2020; the Factories Act and the CLRA map to the Occupational Safety, Health and Working Conditions Code, 2020. When a rule is notified, filter by the Code tag and you have the list of rows to re-score in a minute rather than a week. Keep the legacy reference in place until your Compliance Manager confirms the new rule is operative for that filing.
Beyond the Codes, four habits keep a register honest.
- Re-score on triggers, not just on a calendar. A new site, a first contractor, a notice, a headcount crossing a threshold or a notified rule all warrant an immediate re-score of the affected rows.
- Control score changes. A score is a statement to an auditor. Whoever lowers a High score should need a second person’s approval and a remark.
- Keep history. Store the previous score with the date it changed and why. Without it, the trend heat map is impossible.
- Close the loop on notices. Every notice adds an entry to field 14 and triggers a re-score of that row. Regulatory change tracking feeds the same loop from the other direction.
Spreadsheet or Software: Where the Register Breaks
A spreadsheet is a fair first register. Many strong ones start there, and building the first version by hand teaches you your own obligations. It breaks at predictable points.
| Need | Spreadsheet | Compliance software |
|---|---|---|
| Single owner, one state | Works well | Not required |
| Several editors | Overwritten cells, no record of who changed a score | Role-based access, change history |
| Control evidence | Links to files that move or vanish | Evidence attached to the row, archived |
| Alerts before a deadline | Manual reminders | Tiered alerts tied to due dates |
| Consistent scoring | Depends on the person | Locked scale and required remarks |
| Rule changes across states | Someone must read every gazette | Monitoring matched to your company profile |
| Board reporting | Rebuilt each month | Live dashboard |
| Audit trail | Weak or absent | Built in |
The honest decision rule: stay on the spreadsheet while one person maintains it and the company files in one or two states. Move when a second editor appears, when you add a state, or when you can no longer answer “who changed this score and why?” in one minute. That is also the point where HRMS-bundled compliance modules and standalone statutory platforms start to differ. An HRMS compliance module generally records that a filing happened. A dedicated platform ranks and tracks the risk around it. Our compliance management software guide compares the categories in full.
Eight Questions to Ask Before You Buy Register Software
If you are comparing compliance management software, statutory compliance software or a broader compliance management system, ask every vendor the same eight questions and ask for a live demonstration, not a slide.
- Can I define my own 1 to 5 scoring anchors, and does the tool lock them?
- Does it show inherent and residual scores separately, and does a control need evidence to earn credit?
- Does it produce a site-by-act view that uses the maximum score, not an average?
- Which Acts and states are covered natively, and who maintains register formats when a state amends them?
- Who can change a score, and is a second approver required?
- Is there a full audit trail, and can I export it for an inspection or a due diligence request?
- How does a notified rule change reach my register, and is a human review step built in before anything is enforced?
- Can the tool handle contractor and vendor data, not only my own employees?
A tool that cannot answer questions 2, 5 and 6 produces a prettier spreadsheet, not a register.
How Iztty Runs the Register
Iztty is an AI-powered statutory compliance platform built by Futurex Management Solutions Limited, whose consultants have spent more than a decade building registers for Indian employers by hand. The platform covers the fields and controls in this guide as follows.
- The Compliance Score Meter gives a live 0 to 100% score with act-wise and state-wise breakdown and Low, Medium and High banding, which is the site-by-act view without the manual rebuild.
- The Maker-Checker-DSC workflow routes each register or return through upload and validation, review with mandatory remarks on rejection, digital signing and auto-archive to a document vault. That produces the control evidence your residual scores depend on.
- Regulatory Change Intelligence monitors gazette notifications, EPFO and ESIC circulars and state amendments, and creates tasks matched to your company profile. A human reviews each before anything is enforced.
- The AI Notice Response assistant reads PF, ESIC, labour, S&E and Factories Act notices and drafts a formal reply with an evidence checklist, averaging 4 hours against 3 to 5 days manually.
For compliance consultants and statutory compliance firms: a separate Compliance Consultant account type lets one firm run registers for several client companies. In one anonymised illustration published by Iztty, a 40-client compliance consultancy cut EPF and ESIC notice response from 5 days to 4 hours. It is a representative outcome, not an attributed case study.
If you want to see your own register scored the way this guide describes, book a free compliance audit with Iztty. We start from your current registers and licences and return a scored baseline across your Acts and states.
A 10-Day Plan to Stand Up Your First Register
- Days 1 and 2: Pull every licence, registration and contractor list into one inventory. Confirm which locations are registered for what.
- Day 3: Write one row per obligation per location using the 14 fields. Leave scores blank.
- Day 4: Write and agree your scoring anchors. Get the CFO or CHRO to sign the impact floor for prosecution-exposure rows.
- Days 5 and 6: Score inherent likelihood and impact, with a second person challenging every low score on a prosecution-exposure row.
- Day 7: List controls and attach evidence. Score residual risk only where evidence exists.
- Day 8: Pick 10 KRIs, set amber and red thresholds, and link each to a row.
- Day 9: Build the site-by-act heat map and the top-10 grid.
- Day 10: Walk the top five rows with their owners and agree dates. If this is where a platform helps, request a demo and bring your draft register.
FAQs
What is a compliance risk register?
A compliance risk register is a structured list of every statutory obligation, with one row per obligation per location, recording the owner, likelihood and impact scores, controls, evidence and indicators. It ranks obligations by exposure instead of by due date.
How is a compliance risk register different from a compliance calendar?
A calendar lists what is due and when. A register scores how likely each item is to fail and how bad the consequence would be, so it tells you which item deserves attention first.
How many risks should a compliance risk register contain?
One row per obligation per location. A multi-site employer commonly reaches a hundred rows or more. The register needs ranking and filters rather than a smaller list, and the heat map should show only the top ten.
What is the difference between inherent and residual risk?
Inherent risk is the score before controls. Residual risk is the score after controls you can evidence. A control without evidence of operation in the last 90 days should earn no reduction.
How do I score a compliance risk when I have no history?
Use the anchors, not memory. Score likelihood from the strength of the control (automated, two-person, one-person, none) and impact from the consequence ladder. Treat any obligation with prosecution exposure as impact 4 or higher until proven otherwise.
What is a heat map in compliance risk management?
A heat map is a colour-coded matrix of risk scores. The standard version plots likelihood against impact. A site-by-act version, using the highest score in each cell, shows which location and which Act need attention.
Can I keep my compliance risk register in Excel?
Yes, while one person maintains it and you operate in one or two states. Move to software when multiple editors, more states or the need for a reliable audit trail make spreadsheets unsafe.
What is the difference between an HRMS compliance module and compliance software?
An HRMS compliance module records and files statutory returns as part of payroll. Dedicated statutory compliance software adds ranking, ownership, evidence, contractor tracking and regulatory change monitoring around the filings.
How much does compliance management software cost in India?
Pricing depends on the number of locations, Acts, users and contractors covered, and on whether services are bundled. Ask each vendor for a quote on your own profile, and compare what is included, rather than comparing list prices alone.
Do the Labour Codes change how I maintain my risk register?
Yes. The four Labour Codes took effect on 21 November 2025, with detailed rules still being notified. Tag each row with its legacy Act and its Code, and re-score affected rows when a rule is notified.
Images (3): compliance-risk-register-fields-anatomy.png (after Section 2), compliance-site-by-act-heat-map.png (after Section 5), compliance-kri-amber-red-thresholds.png (after Section 6).
