Compliance & Regulatory Reports

Compliance reporting is the recurring report category where failure is least forgiving. The deadlines are set by rule, the formats are often prescribed, the evidence must be retained, and the audience – a regulator, a lender or a supervisory body – has no interest in how difficult the cycle was. The work is repetitive, and the cost of a missed detail is disproportionate to the effort it would have taken to avoid.

This playbook covers how to produce compliance and regulatory reports reliably: the obligations register, the evidence trail, the approval and retention disciplines, and the checking that keeps a filing defensible. It links to Recurring Report Production and Data Quality for Reporting.

A compliance report is not judged on how it reads. It is judged on whether every figure can be traced, every deadline met, and every version retained.

What compliance reporting is

A compliance or regulatory report is a recurring report required by a rule, an agreement or a regulator. Unlike a board pack, whose content is largely a matter of judgment, a compliance report’s content, format and timing are frequently prescribed.

Its defining features:

• The deadline is fixed by rule, not by internal convenience, and is usually not negotiable.
• The format is often prescribed, down to field names and units.
• The evidence must be retained, so the filing can be defended later.
• The audience is external and unforgiving, with little tolerance for a corrected version.

For these reasons, compliance reporting rewards a control mindset over a writing one. The document is a byproduct of a controlled process.

Build an obligations register

The first artifact in a compliance reporting function is not a template. It is a register of what you must file, when and to whom.

With the register in place, the reporting calendar is a derivation rather than a guess, and a deadline is never discovered late. It also makes the coverage of the function visible: obligations with no named owner are the ones that fail.

The compliance reporting cycle

Within the calendar, the cycle follows the same shape as any recurring report, with more control at each gate.

• Trigger: the deadline rule fires, and the obligation appears on the calendar.
• Gather: the data and evidence are collected from named sources.
• Reconcile: the figures are reconciled to the underlying records.
• Check: the prescribed checks are run against the filed format.
• Review: a named reviewer, separate from the preparer, signs off.
• Approve: the accountable owner approves the filing.
• File: the report is submitted, and the submission is logged.
• Retain: the filing, its evidence and its approvals are archived together.

The separation of preparer and reviewer is the control most often missing in small teams, and the one most often cited when a filing is questioned.

The evidence trail

A compliance report is only as defensible as the evidence behind it.

• Every figure traces to a source – the system, the extract, the date and the verifier.
• Every adjustment is recorded, with its reason and its approval.
• Every version is retained, not just the filed one.
• Every approval is logged, with a name and a date.

The evidence trail is what turns “we believe this figure is right” into “we can show how this figure was produced.” It is also what makes a correction – if one is ever needed – proportionate and demonstrable. See Data Lineage & Traceability in Reports.

Where the data problems sit

Compliance reporting inherits every data weakness in the organization, at the least convenient moment.

The underlying difficulty is well documented. In a 2026 Intuit survey of 2,000 finance leaders, 51% of the finance week went to manual work such as reconciliation and report stitching, and 57% said time-sensitive action had been missed because of delays in getting data. A 2026 study of analytics teams found 78% of analyst time going to preparation and validation.

In a compliance context, those are not productivity statistics. They are control risks: manual stitching is where a figure is transposed, and a delayed reconciliation is where a deadline slips.

The controls that address them are the same as elsewhere – agreed sources, a data-quality checklist, reconciliation and versioning – but the tolerance for exceptions is lower. See Data-Quality Checks for Report Production and Reconciling Numbers Across Reports.

Versioning and retention

A compliance function needs to be able to reproduce any filing, months or years after the fact.

• Freeze the data used for the filing, and record the snapshot.
• Version the filing, and retain the version actually submitted.
• Retain the workings, not only the final form.
• Retain the approvals, so accountability is reconstructable.
• Apply the retention period that the applicable rule requires.

Where any of these is missing, the filing can be reproduced only by memory. That is the gap that audits are designed to find. See Data Refresh & Versioning.

Working with your advisors

Compliance reporting rarely sits entirely inside one team.

• Name the internal owner for each obligation, and the advisor who supports it.
• Agree the review point at which advice is sought – before the deadline, not at it.
• Keep a record of the advice received, alongside the filing it informed.
• Review the obligations register with advisors at least annually, and after any rule change.

Advisors cannot shorten a deadline. Involving them early is what turns a rule change into a scheduled process change rather than a filing scramble.

Common failure modes

• No obligations register. Deadlines are discovered rather than scheduled, and the first sign of a filing is a reminder that it is already due.
• Preparer and reviewer are the same person. The control that catches errors is absent.
• Evidence not retained. The filing cannot be defended.
• Manual stitching untraceable. A figure cannot be traced to its source.
• Only the final version kept. Corrections and workings are lost.
• Format drift. A prescribed field is renamed or reformatted over time, and the process memory lives in the previous version.

What good looks like

• Every obligation has a named owner and a scheduled deadline.
• Every figure traces to a retained source.
• Every filing is reviewed by someone other than its preparer.
• Every version and approval is retained for the required period.
• Every cycle produces a lesson that tightens the next one.

The aim is a function where a filing is routine, defensible and reproducible – and where the effort goes into the control, not into re-deriving the process each time.

What a pilot looks like

Compliance reporting is often the strongest candidate for a pilot because the cost of a miss is high and the process is genuinely repeatable.

A pilot takes one obligation – a filing that recurs on a fixed calendar – and builds the register entry, the evidence trail, the checks and the retention into a repeatable cycle, run twice with your team. At the end, you have a controlled filing process, a documented evidence trail, and a measured comparison of the time it took before and after.

If the pilot does not demonstrate a measurable reduction in production time, there is no obligation to continue. See book a pilot call to scope one against your obligations.

Frequently asked questions

What is the difference between compliance reporting and management reporting?

Compliance reporting is required by a rule, with a prescribed format, deadline and retention requirement. Management reporting is internal and discretionary. The control disciplines overlap, but the tolerance for exceptions is far lower on compliance.

How do you make sure you never miss a compliance deadline?

Maintain an obligations register listing every filing, its deadline rule, its owner and its evidence, and derive the reporting calendar from it. A deadline that is not in the register is a deadline waiting to be missed.

Who should prepare and approve a compliance report?

The preparer and the reviewer should be different people, with an accountable owner approving the filing. Separation of duties is the control most often missing in small teams.

How long should compliance evidence be retained?

For the retention period the applicable rule requires, and at least as long as the filing may be questioned. Retain the workings and approvals, not only the final submitted form. Where the rule is silent, follow your own document-retention policy and record the basis you applied.

What should you do if you find an error in a filed report?

Follow the applicable correction or resubmission procedure for that authority, with counsel where appropriate, and record the correction, its cause and its fix. See When Data Is Wrong.

Can compliance reporting be automated?

The mechanical parts can – data extraction, checks, format population, deadlines – and should be. The judgment parts cannot: whether an adjustment is appropriate, and whether a filing is defensible. Automate first where the process is stable, and keep a human at the approval gate.

How do you handle a compliance report that changes format?

Version the format, record the change and its date, and update the checklist. Format drift is a common source of filing errors, because the process memory is in the previous version.

Is this article legal or regulatory advice?

No. It describes reporting production practice. Confirm your specific obligations, deadlines and retention requirements with qualified counsel or your compliance advisors.

What should a compliance filing checklist include?

The obligation and its deadline, the data sources, the reconciliation to the records, the prescribed format checks, the preparer, the separate reviewer, the approver, the submission log, and the retention of the workings. Run the same checklist every cycle, and version it when the filing format changes.

Next step

Build the obligations register, schedule the calendar from it, separate preparer from reviewer, and retain the evidence, versions and approvals. See How to Produce Recurring Reports on Schedule for the production method, or book a pilot call to run a filing cycle with you.

Sources

• Intuit Enterprise Suite, Future of Finance 2026 Report (survey of 2,000 CFOs, controllers and VPs of Finance at US businesses over $2.5M revenue, May 2026): 51% of the finance week spent on manual work such as reconciliation and report stitching; 57% missed time-sensitive action because of delays in getting data.
• dbt Labs and Quietly, “The Analyst Revolution” (Harris Poll, 2026): 78% of analysts’ time goes to data preparation, validation and tool navigation.

Figures are cited from their sources and dated. Where a source is a vendor benchmark, the sample size is stated. This article is general information, not legal or regulatory advice.