Integrated governance cannot cancel jurisdiction specific law. Resolve competing requirements through a documented applicability, precedence and escalation process.
A global enterprise may face differing retention rules, occupational safety duties, environmental permit conditions, product standards and data protection obligations. The language of these obligations can seem inconsistent, and separate specialists may give mutually incompatible instructions. A simplified “one policy for everyone” approach risks suppressing a legally important difference. An uncoordinated local approach, by contrast, creates divergent controls that central leaders cannot understand or defend.
The practical task is to identify whether requirements really conflict, who has authority to interpret them, and how an operationally workable solution is approved. ISO 37301 addresses compliance management systems; ISO 31000 provides risk management guidance. Neither changes the legal hierarchy within a jurisdiction. Obtain qualified local legal or regulatory interpretation where the consequence is material.
01Distinguish genuine conflicts from different objectives
Two rules may cover different objects rather than contradict each other. A customer specification can demand longer records retention than an internal preference; a privacy obligation can restrict how personal information in those records is accessed. A worker protection requirement can impose an additional inspection even when the quality system already checks equipment. Do not classify a conflict until the regulated activity, jurisdiction, legal entity and exact obligation have been identified.
Build an obligation record with issuing authority, instrument, applicability condition, effective date, owner, required action, evidence and review trigger. Separate binding law, permit, contract, adopted standard and voluntary policy. The hierarchy and ability to choose the stricter rule will depend on the issue; “apply the strictest requirement everywhere” can itself cause legal or operational problems.
The requirements and guidance distinction in the official ISO 37301 publication is relevant when organising compliance responsibilities; legal precedence itself must be resolved through applicable law. See the official publication ↗
02Map jurisdiction and operational ownership
A central register needs local expert ownership. Labour law may attach to the employing entity, an emission limit to a permitted facility and product obligations to the market where goods are placed. Data controls may depend on where information originates and where it is transferred. A single global control statement often cannot carry all these facts.
Assign a legal obligation owner and a process owner to each requirement. The legal specialist interprets the obligation, while the process owner designs and operates the control. Where interpretation is uncertain, record the question and escalation status. Do not allow unresolved specialist opinions to become unlabelled requirements in a generic checklist.
A conflict register should distinguish whether advice is final, provisional or awaiting confirmation. Use a neutral issue owner to coordinate specialists and preserve contradictory advice until it is resolved; overwriting an earlier opinion removes the rationale for later actions. The decision record should also define the operating condition that will trigger a new assessment, for example expansion to a different jurisdiction, a changed permit or a novel data transfer arrangement.
03Use a structured conflict resolution record
Create a short decision dossier for each material conflict. Capture the competing requirements with source dates, the particular activity affected, options considered, affected stakeholders, impact on safety or rights, competent reviewers and final approval. Include interim controls and a review trigger. This record helps an internal auditor understand the reasoning without mistaking a management preference for a regulatory exemption.
Avoid resolving a conflict by averaging incompatible thresholds or deleting one line of a control matrix. If a legal obligation cannot be satisfied by the planned process, stop that process or redesign it until competent advice establishes a viable path. Management may prioritise resources, but it cannot authorise non compliance simply by signing a risk acceptance form.
04Design the shared control with local annexes
A harmonised procedure can define how new obligations are identified, assessed, assigned and verified. Local annexes then capture reporting deadlines, regulator contacts, technical limits, mandatory qualifications and prescribed records. Keep the annex under document control, with a reviewer who understands the jurisdiction. For digital workflows, configure conditional fields rather than hiding local obligations in explanatory notes.
A change to a common system, such as a waste tracking platform, should trigger a review of every location whose records, permits or reporting channels depend on it. Test the logic with realistic exceptions, including emergency operations and contractors. The approval record should show that the relevant specialists accepted the control design.
05Decide which evidence proves compliance
Evidence is not identical to possession of a licence or a compliance calendar. A requirement to inspect equipment needs inspection results, competent execution and disposition of defects. A privacy restriction needs operational access controls and logs where appropriate. An emission permit may need measurement data, methods and evidence of reporting. Define proof at the level the authority and actual obligation require.
When a requirement is satisfied partly by an outsourced service, identify exactly which contractual, technical and monitoring records the organisation can obtain. A service provider’s generic certificate rarely substitutes for evidence that the organisation’s own legal duties were met.
Where country requirements are changing, a common platform needs more than a global tick box labelled compliant. It should record applicable territories, deadlines, relevant corporate entities and the evidence type for each duty. A production manager may be able to verify a training requirement directly, but only regulatory counsel may resolve whether an exemption applies. Respecting that boundary prevents false confidence and unnecessary duplication.
06Handle changes before they affect operations
Introduce a change monitoring process for new laws, regulatory interpretations, court decisions, permit modifications and contract revisions. Not every headline requires immediate policy revision; each relevant change needs applicability screening, risk assessment and an implementation owner. The update should enter engineering, procurement, HR or IT workflows at the point where it can change the operation.
A high quality regulatory update record states what changed, which activities are affected, what controls must be altered, when compliance begins and how readiness will be verified. Keep a superseded obligation history rather than deleting earlier requirements, especially when investigations may review historical activities.
The operating test is to ask a supervisor to work through one real exception using the available procedure. Can the supervisor identify the binding obligation, locate approved interpretation, stop or modify work where necessary and obtain a traceable decision quickly? If the process requires lengthy informal negotiation for each repeat occurrence, revise the routing logic instead of producing a larger explanatory policy.
07Audit the decision trail, not just the register
A compliance audit should sample an obligation from its authoritative source through applicability, control design, operational execution and any regulator submission. Inspect contradictory specialist instructions and whether staff know which decision to follow. A well populated register is useful infrastructure; it is not evidence that each obligation has been fulfilled.
Integrate the compliance review with management review where risk and investment cross disciplines. Present unresolved interpretations explicitly instead of forcing a green status. Serious legal questions need prompt qualified advice independent of the next scheduled ISO audit.
Resolve obligations without hiding uncertainty
Make the next compliance decision transparent: Specify the legal entity, relevant obligation, interpretation authority and interim operating conditions. If specialists disagree, the status should remain unresolved until competent review reaches a defensible conclusion. The strength of integrated governance lies in how it handles a difficult conflict, not how many local rules it can remove.
- Record the legal entity, jurisdiction and effective date for each obligation.
- Escalate genuine incompatibility to authorised legal and technical specialists.
- Use controlled local annexes under a common change process.
- Trace sample obligations through operational evidence and reporting.
Relevant Implementation Resources
Explore editable management system tools and evidence registers aligned to the disciplines discussed in this analysis.