Global NGO compliance is a set of overlapping responsibilities, not a single software setting. An organisation may face statutory reporting duties, donor conditions, privacy requirements and internal approval policies at the same time. A control can be useful across several of these responsibilities, but its presence does not prove that every obligation has been met.
Build a requirements register that explains applicability before it assigns controls. For each obligation, record its source and the entity or activity it covers. Name an owner and specify the evidence and review date. This turns an abstract demand to “be compliant” into decisions that teams can implement and test.
An obligation becomes a control through applicability
Use one row per obligation, with its source and applicability decision. Select only obligations that apply to the NGO's entity, award or processing activities, and record the reason for each decision.
| Obligation Context | Applicability Question | Proposed Control | Evidence To Retain |
|---|---|---|---|
| UK charity reporting | Which regulator, accounting basis and period apply? | Review the return mapping and authorise submission | Applicable guidance, reconciliation and sign-off |
| US federal sub-award | Is this a covered award and a subrecipient relationship? | Risk assessment and proportionate monitoring | Agreement, assessment, reviews and follow-up |
| Canadian registered charity | Is this the charity's relevant fiscal period? | Prepare and review the required return | Approved records and filing confirmation |
| Personal data processing | Which data protection law and roles apply? | Limit access and assess proposed sharing | Processing record, assessment and tested permissions |
The Charity Commission annual-return guidance, CRA T3010 information and US federal assistance guidance provide jurisdiction-specific starting points. Check current applicability with the responsible adviser, then link the decision to the configured control.
For example, a donor may require partner expenditure support before another advance. The control is a release hold until the agreed evidence is reviewed. The evidence is the actual review and release decision, not merely a screenshot showing that a hold field exists. Give exceptions an expiry date and owner so a temporary concession does not become permanent practice.
Statutory, donor and internal rules have different authority
A statutory obligation arises from applicable law or regulation. A donor condition comes from an agreement or funding arrangement. An internal rule reflects the organisation's governance choices. Similar-looking requirements can have different authority, scope and change procedures.
For example, an internal purchase threshold may be amended by the appropriate governing role. A donor's approval condition may require donor consent. A local statutory requirement cannot be removed simply because the global policy allows a different process.
Keep these sources distinguishable in the register. Where a control satisfies several needs, map all relevant obligations to it without replacing their individual applicability assessments. This prevents a later policy update from being mistaken for a change in every underlying requirement.
Which entity, period and activity does the rule cover?
Start with the entity type and jurisdiction. Add the activity, funding arrangement and reporting period that determine whether the requirement applies. Record who assessed applicability and the evidence supporting that decision. “Not applicable” should have a reason; “unknown” should remain visible until resolved.
Assess UK charity reporting, Canadian registered charity records and French association reporting against the relevant entity, registration and activities. An overseas presence alone does not establish which filing duties apply.
Privacy also needs its own assessment. Assess GDPR applicability and responsibilities from the organisation's processing activities; hosting location or a privacy module cannot establish compliance. Assign specialist review where the organisation's activities make applicability uncertain.
Include India in the country register
An Indian entity needs its own applicability assessment within the global model. Use the official FCRA portal for foreign-contribution services and the relevant annual-return workflow. Record the registration or permission status and responsible entity. Retain the bank and ledger mappings, financial period, preparer and review evidence. An overseas donor's address alone does not establish applicability.
Donation reporting also needs a period-specific form mapping. The Income Tax Department's donation statement and certificate page distinguishes the earlier Form 10BD/10BE route from Form 113/114 under the newer Act. Check the applicable tax period and current instructions before reusing a legacy export.
Last reviewed: 19 September 2026.
For personal data, the official Digital Personal Data Protection Rules page provides the rules and enforcement material. Record the relevant commencement provisions rather than assuming every obligation began on the same date.
| Register ID | Required Review | Owner | Evidence |
|---|---|---|---|
| IN-FC-01 | Entity, funding and period applicability | India finance lead | Source version, approved mapping and reconciled return workpapers |
| IN-DON-01 | Donation statement/certificate form for the tax period | Tax reporting owner | Receipt-to-statement reconciliation and filing acknowledgement |
| IN-DATA-01 | Data-processing scope and commencement | Privacy owner | Processing record, assessment and tested controls |
These are internal example control IDs, not government form numbers. Extend the same register to US reporting, German recordkeeping and cross-border data access using each jurisdiction's primary sources.
Who operates the control, and what proves it worked?
Use a control record with enough detail to make testing possible. A label such as “approval workflow” is insufficient without knowing which transactions it covers and what evidence demonstrates that the right authority acted.
| Field | Useful Content |
|---|---|
| Requirement | Specific obligation and authoritative source |
| Applicability | Entity, activity, period and rationale |
| Control | Preventive or detective action |
| Owner | Person responsible for operation and escalation |
| Evidence | Records showing the control operated |
| Review Trigger | Date, legal change, donor amendment or system change |
Security and data-protection requirements illustrate the difference between a feature and an operating control. A system may support access restrictions, but the organisation still needs a process to approve roles, remove departed users and review exceptions.
Manage conflicting requirements
Do not resolve conflicts by silently choosing whichever rule the software can enforce. Document the conflict and affected activity. Set out the interim handling, then obtain a decision from the appropriate legal, finance, privacy or governance owner.
The global-core and country-rule approach can preserve shared controls while allowing justified local configuration. For a local exception, record why it is needed and who authorised it. State its scope and review trigger. It should not become an undocumented fork that the central team discovers only during reporting.
Suppose a donor asks for detailed participant information while the programme's privacy assessment limits routine sharing. First clarify why the donor needs the information and which legal basis applies. Assess whether a smaller report would meet that need. Funding a project does not by itself justify exporting every requested field.
Keep the citation and decision together
For each obligation, keep its authority, source title, URL and relevant provision. Record the publication or amendment date and when it was accessed. Add the applicability decision, reviewer and next review trigger. A bookmarked home page alone is insufficient evidence of the rule applied to a historical transaction. Preserve the operative document version and record why a newer version does or does not change the control.
Test exceptions and update the register
Test whether a control works when the usual path fails. Try an expired approval delegation, a missing source document, a changed award condition or a user attempting to export another team's records. Record observed results and remediation owners.
Review the register when relevant circumstances change. A new country, entity, service, donor agreement or software integration can alter applicability. Retain previous versions so reviewers can understand which requirements and controls applied during an earlier reporting period.
Avoid a single percentage that implies legal compliance. A completed checklist may show that evidence was reviewed; it does not establish that every obligation was identified correctly. Report unresolved applicability, failed controls and overdue actions explicitly.
Map each obligation to its control, evidence and reviewer in the Global Compliance Controls Matrix. An unresolved applicability decision remains an open item even when the related system control has passed its test.
Conclusion
The compliance register should tell a team what applies, what action is required and which evidence is still missing. Keep statutory duties, donor terms and internal policy distinguishable even when one control supports all three. Review entity, period and activity before configuring a rule. Then test exceptions and retain the source version behind the decision. An open applicability question or failed control needs an owner and next action; it should never disappear inside an overall completion score.
Scope your compliance control register
Discuss translating your approved control requirements into a proposed Causeway scope. Bring a requirement register, representative donor conditions and the local variations your advisers have identified.
Ask which controls can be configured and demonstrated, what evidence the system can preserve and where external processes remain necessary. Keep legal interpretation with the appropriate specialists. A useful consultation should produce a clear division of responsibilities and testable requirements, rather than a general promise of automatic compliance.
Frequently asked questions
Which rule applies when donor and local requirements differ?
Do not assume one can simply be ignored. Record the conflict and obtain the relevant specialist and governance review before proceeding. Clarify contractual expectations where necessary and document the authorised approach, including any limits on the activity.
How often should a controls register be reviewed?
Use scheduled reviews together with event-based triggers. Changes in law, entity structure, donor conditions, services or systems may require an earlier review. Give each requirement an owner and retain the date and evidence of the last assessment.
