Compliance Risk Registers: What Due Diligence Teams Look For

1. The Request Founders Underestimate

Sooner or later, a due diligence checklist arrives with a request for “evidence of compliance with applicable labour and employment laws.” Founders often respond with a folder of challans and payment receipts. These documents prove that certain payments were made, but they do not explain which obligations apply, who owns them, where failures have occurred, or what prevents those failures from recurring.

Investors want more than paperwork. They need a clear picture of the company’s statutory compliance position and its ability to manage regulatory exposure.

2. What Due Diligence Teams Look For

Experienced reviewers look for patterns, accountability, and transparency rather than an unrealistic promise of perfection. They assess whether the company understands its obligations, assigns responsibility, maintains evidence, and makes failures visible to management.

A company with two late filings and documented corrective actions may appear better governed than one claiming a spotless record without supporting evidence.

Contract labour receives particular scrutiny. Under the Contract Labour (Regulation and Abolition) Act, 1970, principal employers may face liability for specified contractor defaults. Companies deploying contract workers across multiple sites should therefore demonstrate how they verify contractor compliance, including applicable wage payments and statutory remittances.

3. What a Good Register Shows Them

A compliance risk register brings essential information together in one document. Each entry should identify the statutory obligation, applicable location, responsible owner, risk rating, existing controls, deadlines, and supporting evidence.

A site-by-Act heat map helps reviewers identify locations and legislation associated with the highest residual risks. A documented history of risk-rating changes demonstrates that the company regularly reassesses its exposure rather than preparing the register solely for due diligence.

Key risk indicators provide an additional, forward-looking perspective. Days remaining until a licence expires, contractors with overdue compliance evidence, and statutory registers awaiting approval help management identify emerging problems before they become regulatory failures.

4. What a Register Should Never Hide

Never remove an inconvenient entry simply because it could concern an investor. Late filings, expired licences subsequently renewed, regulatory notices, and unresolved observations should remain documented alongside corrective actions and closure evidence.

Reviewers may discover these issues through other records. Omitting them damages the credibility of the entire register.

Uniformly low risk ratings are equally problematic. If every obligation is rated Low or Medium, reviewers may question whether the scoring methodology genuinely reflects the company's exposure.

India’s four Labour Codes came into effect on 21 November 2025. Their implementation, including applicable rules and transitional requirements, should be assessed carefully. Mapping existing obligations to the relevant Labour Code provisions and tracking applicable notifications demonstrates that regulatory change is being monitored systematically.

5. Preparing Before the Term Sheet

Three actions can significantly improve diligence readiness.

First, establish a register with clearly defined scoring criteria, evidence requirements, accountable owners, and review dates. Second, audit contractors across every site where contract labour is deployed, verifying applicable records and statutory remittances. Third, require independent approval for material risk-rating changes to demonstrate management oversight and preserve an auditable history.

The objective is not to create a register that makes the company look compliant. It is to create one that shows where the company stands, what evidence supports that position, and what management is doing about identified gaps.

That is the difference between claiming compliance and demonstrating control. For detailed field lists, scoring anchors, and key risk indicators, consult the Iztty guide to the compliance risk register.