Compliance Attestation Checklist Template

Start about five weeks before launch. The first task names the four people and asks whether this is the first campaign and whether the organisation files reports with the US SEC; each answer adds the tasks it needs. Every due date counts from the launch date, in working days.

• Set up the attestation campaign — the organisation, the campaign name, the launch date (which every due date counts from), who the results go to, whether this is the first campaign, whether the organisation files reports with the US SEC, and the four people; later tasks are assigned from these fields
• Review last year’s campaign and its open actions — the completion rate, late and missing responses, the disclosures and exceptions still open, and anything the board or committee asked for
• Agree the purpose and the rules of the campaign — who owns it, which policy asks for the attestation, what happens when someone does not attest or qualifies a statement, and who sees the answers
• Check the code of ethics covers the senior financial officers — a code that applies to the principal executive, financial and accounting officers, meets the Item 406(b) definition, and is filed, posted on the website or offered on request
• Decide what people attest to — the code of conduct, named key policies, conflicts of interest, gifts and hospitality, and required training completed, with one statement for each
• Decide who attests — employees, directors and officers, contractors and temporary staff, and any agents or business partners asked to certify, with the statements each group gets
• Set the timetable — the launch date, the response deadline, the reminder and chase dates, the review period and the date of the board or committee meeting that receives the report
• Choose how responses are collected and recorded — the tool, how each response is tied to the person and the version they saw, how it is time-stamped, and how a disclosure reaches the reviewer and nobody else

Statements that name the current version of each policy, a way to disclose an exception rather than only agree, and a population list that matches HR records today, not last year.

• Confirm the current version of each policy in scope — the version, approval date and owner from the policy register; a policy in the middle of its review is attested at the version staff can read today
• Draft the attestation statements — short, plain statements that say what “I have read and will follow” means, name each policy and version, and let people disclose an exception instead of only agreeing
• Add the disclosure questions — new conflicts of interest, gifts and hospitality given or received above the threshold, outside roles, and known or suspected breaches, each with a nil answer and a free-text box
• Pull the training completion records — completion of each required course from the learning records, so the training statement can be checked against them instead of taken on trust
• Build the population list from HR records — name, role, department, manager, location, type of worker and start date, and the statements each person gets
• Reconcile the population with joiners, leavers and last year’s list — joiners, leavers, role changes and people on long-term leave, so nobody is missed or chased in error
• Update the privacy information for the campaign — why the answers are collected, who sees a disclosure, and how long the records are kept
• Write the launch message and the staff FAQ — what to do and by when, a named contact, how to disclose an exception, and that a disclosure is a way to ask for a decision, not an admission

Nothing after the approval of the statements and the launch plan can be completed until it is given. Approved with changes and Not approved each add a task that says what to do next.

• Test the campaign with a pilot group — a few people in different roles complete it; check the links, the statements, the disclosure route and the record each response leaves
• Approve the statements and the launch plan — the approver checks the statements, the disclosure questions, the population and the privacy information, then records the decision; nothing after this task can be completed until it is done
• Make the changes the approver asked for — each change made before launch, and the approver told what changed
• Revise the campaign and record a fresh decision — the campaign owner makes the changes, then the approver records a new decision here; do not launch until it reads Approved
• Brief managers before launch — what is coming and when, how they help chase their teams, and where to send questions; managers do not see their team’s disclosures
• Launch the campaign — send it to the population on the launch date, with the deadline and the named contact, and record how many people it reached
• Answer questions during the window — log each question and the answer given, and add the common ones to the staff FAQ

A campaign that only sends the statements proves people were asked. Chasing by name, with managers copied and an escalation route, is what turns it into a completion rate the board can rely on.

• Check response rates after the first week — by department, location and manager, and fix access problems before the reminder goes out
• Send a reminder before the deadline — to everyone who has not responded, restating the deadline and the contact
• Chase non-responders after the deadline — each person by name with their manager copied; for directors and officers, through the company secretary or the chair
• Escalate people who still have not responded — to the senior manager responsible and HR, with the chase history, and apply what the policy says happens next
• Record agreed exceptions and late responses — long-term leave, new joiners and role changes, each with a new date and who agreed it
• Close the campaign and confirm the final figures — attested, attested with a disclosure, not responded and excused, against the population list

Every disclosure gets a reviewer, a decision and a reason. The answer on the last-but-one task decides whether the escalation phase appears.

• Log every disclosure and exception in the review register — the person or a reference, the statement, what was disclosed, the category and the outcome, starting as they arrive
• Review the conflict of interest disclosures — against the register of interests; new or changed interests go through the organisation’s conflict of interest process for assessment and mitigation
• Review the gifts and hospitality disclosures — against the gifts register and the policy limits; items above the threshold that never reached the register are a finding
• Check training statements against the training records — people who attested to training the records do not show as complete, and how each one was resolved
• Review refusals, qualified statements and reported breaches — anyone who declined to attest, changed a statement or reported a known or suspected breach, and why
• Check senior officers’ exceptions for code of ethics waivers — an exception by the principal executive, financial or accounting officer that the organisation approves, or fails to act on, may be a waiver that must be disclosed
• Decide whether any disclosure needs escalation — a suspected breach of law or of the code, a serious conflict, or a refusal that needs a formal response; Yes adds the escalation phase
• Record the outcome for each disclosure — no action, mitigation agreed, a registers update, training, a policy clarification or escalation, with who decided and why

Applies only when a disclosure needs escalation. The details stay with the people who need them, and each matter is tracked to a recorded outcome.

• Refer each escalated matter to the right process — whistleblowing, an investigation, HR, legal or the conflict of interest process, each with an owner and a reference
• Restrict the details to the people who need them — access to the disclosure and the evidence limited as soon as the matter is escalated, and the person who disclosed protected from retaliation
• Take advice on whether anything must be reported — legal advice on whether a regulator or another authority must be told, with the decision and who made it
• Track each escalated matter to closure — the status of each referral, reported to the board or committee in summary without names

The report gives completion, exceptions and disclosures in summary. The approver checks it before it goes, without halting the checklist.

• Analyse the results — completion by department and location, repeat non-responders, the kinds of disclosure, and the training mismatches
• Compare the results with last year’s — completion rate, disclosures by kind, and whether last year’s actions made a difference
• Draft the report to the board or committee — the completion rate, exceptions and disclosures in summary, escalations without names, the follow-up actions and what will change next year
• Approver reviews the report — the approver checks the figures and the wording before it goes to the board or committee
• Present the report and record the response — the meeting date, the minute reference and any actions the board or committee asked for
• Assign and track the follow-up actions — policy clarifications, training, process fixes and register updates, each with an owner and a due date

The record shows who was asked, who answered, what they saw and what was done with each disclosure. Keep it for the period your retention schedule sets, then delete it.

• Update the registers from accepted disclosures — the register of interests and the gifts and hospitality register, so they match what people disclosed
• File the campaign record — the population, the statements and versions, every response with its time stamp, the chase history, the disclosures and outcomes, and the report
• Set the retention date for the records — the period your retention schedule sets for attestation records, and the date they are reviewed or deleted
• Set up attestation for joiners between campaigns — new joiners and people who change role attest when they start, so nobody waits up to a year
• Set the date of next year’s campaign — the next launch date, and the events that would bring it forward: a new code, a merger or a serious breach