Module 1
What regulatory mapping is: from rule to obligation, control and evidence
A regulation is written for a whole industry. A business has to answer it with something much smaller and more concrete: a named person doing a named thing by a named date, and a record that shows it was done. Regulatory mapping is the work of getting from one to the other. It starts with the text of the law and ends with evidence that a control is working, and every step in between can be written down, linked and checked. Most organisations do this informally, in the heads of two or three people, and it works until one of them leaves, a new regulation arrives or a regulator asks to see how a particular duty is met. This course teaches the discipline as a whole: finding the obligations, deciding whether they apply, linking them to controls, handling overlap between regimes, keeping the map current and measuring whether it all works. This first module sets out the chain, the vocabulary and the reasons for building a map, and says plainly what a map cannot do. It is written in jurisdiction-neutral terms with invented regulations and companies, and it tells you what to check in the law where you work.
Hover over an idea to light up what it connects to, click it for its definition, minimum requirements, an example and the usual trap, press Play to watch the map build step by step, or trace a short case through it.
Simplified teaching map, in general terms. Check the law where you work. On a small screen, scroll the map sideways.
By the end of this module you can
- Describe the chain from regulation to test.
- Say why compliance is a data problem.
- Describe an obligations register.
- Assign ownership to each link.
- State what a map cannot do.
Part 1. The lecture
The chain: regulation, obligation, control, evidence, test
Five links connect a law to the daily work of a business. Naming them separately is the first step, because many compliance problems come from running two of them together.
| Link | What it is | Example (invented) |
|---|---|---|
| Regulation | The legal text: statute, regulation, guidance, licence condition or standard that binds the business | The Marlen Digital Safety Act, Article 5 |
| Obligation | One thing the business must do or not do, in a form that a person can act on | A provider must report a serious incident to the Authority within 72 hours |
| Control | The process, system or rule that makes the obligation happen | An incident response plan with a regulator-reporting step and an on-call duty officer |
| Evidence | The record that shows the control ran | The incident log, the timestamp of the report, the Authority’s acknowledgement |
| Test | A check that the control works and the evidence is real | A quarterly drill, and a review of last quarter’s incidents against their reports |
- One regulation, many obligations. A single article can contain five duties. Treating the article as one item hides four of them.
- One obligation, many controls. A serious duty should usually have more than one line of defence.
- One control, many obligations. A single access-control process may help meet duties in several regimes. That is efficient, and it concentrates risk.
- Evidence is part of the chain. A control without evidence cannot be shown to a regulator or an auditor, and so counts for little.
Compliance is not the same as having a policy
A policy states what should happen. The chain asks who does it, how it is triggered, what record it leaves and who checks. A business with a good policy and no controls, evidence or tests is relying on hope.
Why compliance is a data problem
Each link in the chain is a record with fields, and the records point at one another. That is a data structure, and it behaves like one.
| Question a regulator, auditor or board member asks | What the data must be able to answer |
|---|---|
| How do you meet the 72-hour reporting duty? | Which controls are linked to this obligation, and who owns them |
| What changed when the new rules took effect in March? | Which obligations have a changed version, and which controls and owners are affected |
| Which of our obligations have no tested control? | A count of obligations by cover status |
| If this system fails, what are we exposed on? | Which obligations depend on controls running on this system |
| Do we apply this regulation at all? | A recorded scope decision, with its facts and its date |
- Without a structure these questions take weeks, and the answers differ depending on who is asked.
- With a structure they take minutes, and the gaps become visible before a regulator finds them.
- The structure can be modest. A well-kept spreadsheet with stable identifiers is a data structure. A specialist system is a convenience, not a requirement.
- Identifiers matter. An obligation needs a stable code, so that a control can be linked to it and a change can be traced. A sentence copied into three places is three records that will drift apart.
The obligations register and who owns what
The core of the map is the obligations register: one row per obligation, with enough fields to run the rest of the chain.
| Field | What it holds | Why it matters |
|---|---|---|
| Identifier | A stable code, such as MDSA-5-04 | Links and change tracking |
| Source | Regulation, article and version date | Lets anyone check the text |
| Obligation | One sentence: who, must or must not, what, when | One duty per row |
| Type | Duty, prohibition, permission or recommendation | Permissions and recommendations are treated differently |
| Applies? | Yes, no or unclear, with the reason and the date | Scope is a decision to be recorded |
| Severity | How bad a failure would be (penalty, harm, licence risk) | Sets priority |
| Owner | One named role accountable for meeting it | Without an owner, no one acts |
| Controls | Links to the controls that meet it | The cover question |
| Status | Gap, paper cover, tested, retired | Drives the work plan |
- The owner of the obligation is not always the owner of the control. The head of compliance may own the obligation to report incidents; the head of security may run the control that does it.
- Three lines. The business runs the controls, compliance and risk oversee them, and internal audit checks both. A map should make it clear which line each link belongs to.
- Legal judgement belongs at the top of the chain. What the text means and whether it applies are legal questions. The lower links are operational and can be tested with data.
What goes wrong, and what a map cannot do
| Failure without a map | How it shows |
|---|---|
| A duty nobody owns | A regulator’s inquiry reveals that no one knew a report was due |
| A control nobody can link to a duty | Effort is spent on controls that no regulation requires, while real duties go unmet |
| A change not noticed | The business runs to last year’s deadline |
| Duplicate work across regimes | Three teams collect the same evidence for three regulators |
| An unrecorded scope decision | No one can say why the business believed it was exempt |
- A map does not make you compliant. It shows what you intend and what you can prove. Compliance is the result of the controls working in practice.
- It is only as good as its reading of the law. A mistaken interpretation, carefully recorded, is still a mistake. The text at the top of the chain needs a lawyer.
- It does not remove judgement. Standards such as ‘appropriate’ and ‘reasonable’ remain, and someone must decide what they mean here.
- It goes stale. A map that is not updated is worse than none, since it looks authoritative.
- It can create evidence against you. An honest register that records a known gap is a document a regulator can read. That is a reason to fix gaps and keep an honest register, not a reason to hide them.
The rest of the course follows the chain: reading the text (Module 2), deciding scope (3), linking to controls (4), handling several regimes (5), keeping up with change (6) and measuring (7). The four tools in the course are small versions of the working tools that a compliance team builds.
Part 2. Lab: Where Are We in the Chain
Choose the best next step in each situation.
Situation 1 of 3
A new regulation has been published. The head of compliance says, ‘We should be fine; we have a policy for most of this.’
What is the best next step?
Part 3. Lab: Which Link Is It
Sort each item by the link in the chain to which it belongs.
Situation 1 of 6
A provider must keep records of each notice for five years.
Where does this belong?
Part 4. Lab: Spot the Gap
Click the sentences that reveal a weakness in the map, or mark the sound ones.
A compliance team’s status note
Click every sentence that causes a problem, then press Check. There may be 3 problems, and some sentences are fine.
Part 5. Check your understanding
Ten questions drawn from a larger pool. Sign in to have your score saved towards your certificate.
You have finished the free module
Here is what you can do now, and where the course goes next
Module 1 gave you
- Describe the chain from regulation to test.
- Say why compliance is a data problem.
- Describe an obligations register.
- Assign ownership to each link.
- State what a map cannot do.
Next, 6 more modules and a capstone
- Module 2: Finding and reading obligations: from sentences to dutiesYou will learn to name the six parts of an obligation.
- Module 3: Scope and applicability: does the regulation reach us, and how far?You will learn to name the kinds of scope test.
- Module 4: Mapping obligations to controls: coverage, gaps and single points of failureYou will learn to distinguish preventive, detective and corrective controls.
- Module 5: Many regulations, one framework: overlap, crosswalks and conflictsYou will learn to find overlap between regimes.
- Module 6: Tracking regulatory change: from horizon scan to updated map
- Module 7: Compliance analytics and metrics: measuring whether it works
- Capstone: Capstone: Corvane Pay enters Marlen
Each module has its own practice labs and a graded quiz, and a Certificate of Completion follows when you pass them all. The whole course is $15 once, or included in an All-Access Membership.
Two Ways In
Introductory PriceRegulatory Mapping and Compliance Analytics: buy it on its own, or get it with All-Access
Unlock all of Regulatory Mapping and Compliance Analytics on its own with a one-time purchase, or get it as part of an All-Access Membership, which also covers every course and the other paid tools. A member never needs to buy it separately.
This is an early, introductory price for a brand-new product — it’s expected to rise as we add more content. Buy now and it’s yours at today’s rate, forever.
No account needed: you pay, and we email you a one-click sign-in.
All-Access is $19.99 a month or $149 a year, and covers every course and most tools, this one included. Create a free account to subscribe.
Look first, then buy. Free previews on every product page. Secure payment by Stripe. Pay once, keep it forever. Details
See what is included in All-Access →Not ready to buy? Create a free account to save your quiz scores and your place in this course, and to get the printable reports from the practice rooms.
General education on regulatory mapping and compliance analytics, using invented regulations, regulators, companies and figures. It states common practice in simplified form and does not describe any one country's law, which differs and changes; rules on scope, interpretation, reporting, record keeping, monitoring of staff and penalties in particular vary. It is not legal or compliance advice, and it does not replace advice from a qualified lawyer on a real regulatory question.
Teaching? Share this with your class
Free to use in class. The free parts open for everyone, no account needed.