This free compliance calendar checklist is for compliance leads, company secretaries and the operations and finance managers who carry a list of dated obligations. It builds the year’s obligations register, gives every item an owner, a backup, a date and a lead time, puts each one on its own recurring schedule, then runs monthly and quarterly check-ins and a year-end review that rolls the register into next year. Each recurring item points to the template that does the work, so the calendar stays a plan rather than a copy of every process.
A compliance calendar is the register of every obligation that falls due on a date, with the person who will meet it and the day they need to start. Dates come in three kinds. Fixed dates are set by a rule and fall on the same day every year, like a posting window. Anniversary dates run from something you did, such as a certificate issue date or the date of your last filing, and they move when you act early or late. Self-set cadences are dates you choose to satisfy a standard that says ‘planned intervals’: internal audits, policy reviews, access reviews.
The calendar fails in predictable ways. Anniversary dates are copied forward from last year when the anchor has moved. Lead times are missing, so the reminder arrives on the deadline. Items belong to a team rather than a person. And event-driven duties are forced into the calendar where they do not fit.
Filings and postings: statutory returns, annual summaries and fees on a fixed or anniversary date.
Certifications and licences: surveillance audits, renewals and expiry dates.
Internal cadences: audits, policy reviews, control testing, declarations and training windows.
Board items: annual approvals timed to the meeting that gives them.
Requests: a data subject access request starts its own one-month clock.
Incidents: breach notifications and serious injury reports run from the incident, or from when you learn of it.
Reports: whistleblowing reports have their own acknowledgement and feedback deadlines.
These need a process template ready to start. The calendar holds only their periodic metrics review.
The calendar decides when things happen. What happens is in each item’s own template: the Annual Policy Review Checklist, for example, runs the review that the calendar schedules.
Six phases. Your jurisdictions and certifications decide which items are added, and the check-ins run on their own monthly and quarterly schedules.
The first task records the jurisdictions and certifications that bring in the Phase 2 items, and names the compliance lead who signs off the year-end review.
The first four tasks appear according to the jurisdictions and certifications chosen in Phase 1.
These are dates you choose. Spread them so the same people are not hit by every review in one quarter.
Each register line becomes its own recurring schedule that starts the item’s template on time.
The first three tasks run as a short checklist on a monthly schedule, the last three on a quarterly one, each assigned to the compliance lead.
The approval is assigned to the compliance lead named in Phase 1. The annual schedule then starts next year’s checklist.
The first rows are external dates with their source. The rest are cadences you set to meet a standard, with the template that runs each one. Which items apply depends on your size, sector and locations, so treat the table as a starting point, not legal advice.
| Calendar item | Date or cadence | Set by | Run it with |
|---|---|---|---|
| OSHA Form 300A annual summary posting (US) | Posted by 1 February, kept up until 30 April | 29 CFR 1904.32(b)(6) | OSHA Recordkeeping Checklist |
| OSHA electronic submission (US, covered establishments) | By 2 March for the previous calendar year | 29 CFR 1904.41(c) | OSHA Recordkeeping Checklist |
| Form 5500 annual return for employee benefit plans (US) | Last day of the seventh month after the plan year ends; Form 5558 extends by up to two and a half months | IRS and Department of Labor | Phase 2 |
| Confirmation statement (UK companies) | At least once every 12 months, filed up to 14 days after the review period ends | Companies House | Phase 2 |
| Data protection fee (UK controllers) | Each 12-month charge period | Data Protection (Charges and Information) Regulations 2018, reg. 2 | Phase 2 |
| Cyber Essentials certificate (UK) | Expires 12 months after issue | IASME | Cyber Essentials Checklist |
| ISO certification surveillance audit | At least once a calendar year between three-yearly recertifications | Your certification body | ISO 27001 Internal Audit, ISO 9001 Internal Audit |
| PCI DSS scope confirmation and policy review | At least once every 12 months | PCI DSS v4.0.1 Requirements 12.5.2 and 12.1.2 | PCI DSS Compliance Checklist |
| SOX 404 assessment, control testing and ITGC review | Annual assessment; testing through the year | Your audit plan | SOX 404, Control Testing, ITGC Review |
| Policy library review | Annual by convention | Your governance framework | Annual Policy Review |
| Conflict of interest declarations | Annual campaign | Your policy | Conflict of Interest Declaration |
| GDPR audit and access request metrics | Annual audit; quarterly metrics | Self-set | GDPR Audit, DSAR Response |
| Access and segregation of duties reviews | Quarterly | Self-set | User Access Review, SoD Review |
| Vendor reassessment and data retention review | By risk tier; annual | Self-set | Vendor Risk, Data Retention |
Dates and thresholds were checked in October 2026. Several depend on facts about you: OSHA electronic submission applies by establishment size and industry, and the confirmation statement date moves if you file early. Check each rule against its source when you roll the calendar forward, because filing requirements and fees change between years. Nothing on this page is legal advice.
Each register line becomes a recurring schedule, monthly, quarterly, annual or custom, that starts the right checklist at the start of its lead time. The owner receives a checklist with steps and due dates rather than a calendar reminder.
Conditional logic adds the UK, US, EU and certification tasks only where they apply. Keep the obligations themselves in a data set, a reference table that fills checklists, so a new site or licence is one row, not a new spreadsheet.
Filing receipts, posted notices and certificates attach to the task that met the deadline. The activity trail shows who completed each item and when, so the year-end reconciliation, and any regulator’s question, is answered from the record.
CheckFlow is not a GRC platform or a regulatory change service, and it does not give legal advice. It will not tell you which laws apply to you; it makes sure the obligations you identify are owned, started on time and evidenced. CheckFlow’s recurring checklist software runs the schedules, and compliance checklist software covers the templates behind each calendar item.
For IT-heavy calendars, our guide to recurring compliance checklists for IT teams shows how to set cadences for patching, backups and access reviews. Every template in the table above can sit behind a calendar line, and the full set is in the compliance template library.
Every obligation with a predictable date: statutory filings and postings, fees, licence and certificate renewals, certification audits, internal audits and control testing, policy reviews, declaration campaigns, training windows and board approvals. For each, record the source, the rule behind the date, this year’s date, the owner and backup, the lead time and the evidence that proves it was met.
Work back from the external date through every dependency: data gathering, review, sign-off and any board meeting. A simple online filing may need two weeks. An annual summary that a company executive must certify needs the log closed and reviewed first. A certification audit needs the auditor booked months ahead and internal audits finished before it. Record the lead time in the register and start the item’s checklist on that date.
Under 29 CFR 1904.32, no later than 1 February of the year after the one the records cover, kept in place until 30 April, in a conspicuous spot where employee notices usually go. A company executive must certify the summary first. Establishments covered by 1904.41 must also submit it electronically by 2 March. The OSHA Recordkeeping Checklist runs the whole cycle.
Every company must file at least once every 12 months. The review period ends 12 months after incorporation, or after the confirmation statement date on the last statement, and you have up to 14 days after that to file. File early and you choose a new date, which moves next year’s deadline. That is why the calendar should store the rule, not just last year’s date.
Not in the way a statutory filing does. The GDPR’s deadlines are triggered by events, such as an access request or a breach. What the calendar holds are the reviews you choose to keep it working: an annual audit, a review of the records of processing and DPIAs, and a quarterly look at request metrics. In the UK, the data protection fee is a genuine 12-month obligation.
One compliance lead owns the calendar itself: the register, the check-ins and the year-end review. Each obligation is owned by the person who does the work, usually in finance, HR, health and safety, IT or the company secretariat, with a named backup. Splitting it this way keeps the compliance lead from becoming the person who files everything.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
