The method
For every provision in the register, three columns are filled: is it met, what is the evidence, who evaluated it and when. A line with an empty evidence column has not been evaluated — writing “yes” is not an evaluation.
Different from an internal audit
| Compliance evaluation | Internal audit | |
|---|---|---|
| Criteria | Legal and other requirements | The management system's requirements |
| Its question | Are we lawful? | Does the system work? |
| Independence | Not required, but preferable | Required |
Neither replaces the other; an internal audit also asks whether the compliance evaluation was done.
Frequency
“At planned intervals” — the frequency follows risk. Areas that change often and carry heavy sanctions (fine amounts, inspection periods, training renewal) are evaluated more often; stable framework provisions less often.
Where the result goes
The result is an input to the management review. An unmet provision does not close until resources are decided there.
The trap of “partly met”
Writing “partly” is comforting and says nothing on its own. Unless which part is met and when the gap closes are written down, the line is copied unchanged into every future evaluation.