Legal Compliance Management Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Compliance Manager, Legal Counsel and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-L-033

Before you join: Participants should have basic workplace experience in legal, compliance, risk, audit, governance, operations, human resources, procurement or a regulated business function.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Legal and compliance teams must turn statutes, regulations, licence conditions, regulator guidance and contractual duties into controlled business activity. Failures often arise not because a requirement was unknown, but because ownership, evidence, monitoring and escalation were unclear. The result can include enforcement action, fines, disrupted operations, damaged customer trust and personal exposure for directors or senior managers.

This course develops the practical discipline required to identify applicable legal duties, assess compliance risk, design controls and demonstrate that those controls operate. Participants work through legal obligation registers, risk assessments, control matrices, policy structures, regulatory change processes, third-party checks, investigations and reporting routes. The programme addresses common statutory areas including data protection, employment, health and safety, environmental duties, anti-bribery, sanctions, competition and consumer protection, while recognising that legal requirements differ by jurisdiction and sector.

Instructor-led sessions combine short technical briefings with cases from regulated businesses, public bodies, manufacturers, financial institutions and international organisations. Participants apply ISO 37301 compliance management principles, ISO 31000 risk methods, COSO ERM concepts and the Three Lines Model to their own operating context. By the final module, each participant has built and presented a compliance management pack containing an obligation inventory, risk and control assessment, monitoring plan, reporting approach and implementation priorities.

The course suits professionals who already work with policies, controls, risk, audit, legal matters or operational assurance and now need a structured method for managing statutory legal and compliance requirements. It is particularly useful where responsibility is distributed among business units, country offices, specialist functions and external providers.

What you will be able to do

  • Map applicable legal, regulatory, contractual and licence obligations into an obligation register
  • Assess compliance risks using likelihood, impact, control effectiveness and residual-risk criteria
  • Design compliance controls and assign accountable owners through a RACI matrix
  • Build a regulatory change process with impact assessment, action tracking and evidence requirements
  • Draft policy, procedure and control documentation that translates legal duties into operational actions
  • Plan monitoring, testing and internal reporting using risk-based assurance methods
  • Manage compliance incidents, investigations and regulator communications using documented escalation protocols
  • Present a complete compliance management pack for senior management review

Benefits of attending

For you

  • Produce legal obligation registers suitable for management and audit review
  • Translate legal requirements into practical controls, owners and evidence
  • Identify weak compliance controls before they become reportable failures
  • Contribute confidently to regulatory inspections, audits and internal investigations
  • Build a documented compliance management pack for immediate workplace use

For your organisation

  • Clearer ownership of statutory obligations, controls and corrective actions
  • Earlier detection of non-compliance through structured monitoring and testing
  • Better evidence for regulators, auditors, boards and external counsel
  • Reduced duplication between legal, risk, audit and operational assurance teams
  • More consistent response to regulatory change, incidents and remediation work

Course modules

20 modules over 10 days

Participants can distinguish legal duties from internal commitments and structure a compliance management system.

  • Sources of law: statutes, regulations, licences, permits, contracts and guidance
  • Legal duties, regulatory expectations and voluntary commitments distinguished clearly
  • Compliance management system components under ISO 37301
  • Directors' duties, senior accountability and delegated authority arrangements
  • Jurisdictional scope determined for entities, branches, products and services
  • Materiality thresholds used to prioritise legal and regulatory obligations

Participants can establish governance structures that assign and oversee compliance responsibilities.

  • Board oversight duties, committee mandates and compliance reporting lines
  • RACI matrices assign accountable, responsible, consulted and informed roles
  • Three Lines Model clarifies management, oversight and assurance responsibilities
  • Compliance officer independence, authority, resources and access to leadership
  • Delegations of authority matched to regulated decisions and approvals
  • Escalation thresholds defined for breaches, investigations and regulatory notifications

Participants can create a legal obligation register linked to business activities and owners.

  • Obligation register fields: source, duty, owner, control, evidence and review date
  • Statutory requirements extracted using issue, duty, trigger and consequence analysis
  • Business-process mapping links obligations to operational activities and decisions
  • Licence conditions translated into recurring operational and reporting requirements
  • Contractual compliance clauses captured alongside statutory and regulatory duties
  • Legal counsel advice recorded as actionable obligations and interpretation notes

Participants can manage legal change from initial alert through implementation verification.

  • Regulatory horizon scanning sources, alerts, consultations and enforcement publications
  • Change impact assessments identify affected processes, systems, people and suppliers
  • Implementation plans set actions, owners, dates, dependencies and evidence
  • Legal updates classified by urgency, significance and effective date
  • Regulatory change logs retain decisions, assumptions and completion records
  • Post-implementation reviews confirm new duties have entered normal controls

Participants can assess inherent and residual compliance risk using defined criteria.

  • Risk statements connect obligation, failure event, cause and consequence
  • Inherent risk scored before considering existing controls and mitigations
  • Likelihood and impact scales calibrated for legal and regulatory exposure
  • Control effectiveness assessed through design, operation and evidence quality
  • Residual-risk ratings drive treatment priorities and management escalation
  • ISO 31000 principles applied to compliance risk assessment governance

Participants can design controls that prevent, detect or correct compliance failures.

  • Preventive, detective and corrective controls selected against defined compliance risks
  • Control objectives specify the legal duty and intended assurance
  • Control matrices link risks, controls, owners, frequency and evidence
  • Segregation of duties reduces conflicts, override risk and unauthorised decisions
  • Evidence standards define records, retention periods, access and approval trails
  • Key controls prioritised where failure could trigger enforcement or harm

Participants can translate legal requirements into usable policy and procedure documents.

  • Policy architecture distinguishes principles, mandatory rules, procedures and guidance
  • Plain-language drafting converts legal obligations into required employee actions
  • Document hierarchies resolve conflicts between global and local requirements
  • Approval workflows confirm legal review, business ownership and version control
  • Exception processes document rationale, authority, duration and compensating controls
  • Retention schedules align records management with statutory limitation periods

Participants can assess and control legal compliance risks arising from third parties.

  • Third-party segmentation considers service criticality, jurisdiction and regulatory exposure
  • Due diligence checks ownership, sanctions, integrity, capability and adverse media
  • Contract clauses specify compliance obligations, audit rights and termination triggers
  • Supplier onboarding controls verify licences, certifications and required insurance
  • Ongoing monitoring detects ownership changes, adverse events and control failures
  • Remediation plans address third-party breaches, deficiencies and repeated nonconformance

Participants can identify core privacy duties and document proportionate data controls.

  • Data inventories identify personal data, purposes, systems and recipients
  • Lawful-basis assessments document authority for each processing activity
  • Privacy notices meet transparency, retention and individual-rights requirements
  • Data protection impact assessments address high-risk processing activities
  • Cross-border transfer assessments identify safeguards, restrictions and approval requirements
  • Breach triage records containment, notification decisions and remedial actions

Participants can map workplace legal duties to practical employment controls and records.

  • Employment lifecycle obligations cover recruitment, contracts, pay, leave and termination
  • Right-to-work checks recorded using jurisdictionally required evidence and timing
  • Working-time controls monitor hours, rest periods and overtime approvals
  • Harassment and discrimination controls define reporting, investigation and protection measures
  • Employment records retention supports inspections, disputes and statutory reporting
  • Manager guidance addresses consistent treatment, documentation and escalation routes

Participants can manage health and safety legal duties through risk controls and evidence.

  • Hazard identification links workplace activities to legal safety duties
  • Risk assessments document hazards, exposed persons, controls and review dates
  • Safe systems of work specify authorised methods and supervision requirements
  • Incident reporting distinguishes injuries, dangerous occurrences, near misses and notifications
  • Competence records demonstrate training, certification, supervision and refresher requirements
  • Contractor safety controls define permits, induction, monitoring and stop-work authority

Participants can control environmental legal duties, permits and reporting obligations.

  • Environmental aspects registers identify emissions, waste, water and resource impacts
  • Permit conditions translated into monitoring, operating limits and reporting calendars
  • Waste classification controls govern storage, transport, disposal and documentation
  • Spill response arrangements assign containment, notification and investigation responsibilities
  • Environmental records support regulator inspections, permit renewals and management review
  • Supplier controls address restricted substances, packaging and disposal obligations

Participants can assess and control integrity risks involving payments, intermediaries and restricted parties.

  • Anti-bribery risk assessments examine markets, transactions, intermediaries and approvals
  • Gifts, hospitality and sponsorship registers support threshold-based approval decisions
  • Sanctions screening identifies restricted parties, ownership links and prohibited dealings
  • Red flags trigger enhanced due diligence, escalation and documented decisions
  • Whistleblowing arrangements protect reporters and route concerns for independent review
  • Fraud controls address payment diversion, false invoices and management override

Participants can identify conduct risks affecting customers, competitors and market integrity.

  • Competition law red flags cover pricing, bid-rigging and information exchange
  • Trade association protocols prevent improper discussions with competitors
  • Consumer communications reviewed for accuracy, substantiation and fair presentation
  • Product claims evidence supports advertising, labelling and sales statements
  • Complaint trends analysed for conduct failures and remediation priorities
  • Sales incentives assessed for customer harm, conflicts and mis-selling risk

Participants can triage compliance concerns and plan defensible internal investigations.

  • Incident triage assesses urgency, legal exposure, evidence preservation and notification duties
  • Investigation plans define scope, allegations, roles, milestones and confidentiality controls
  • Document holds prevent destruction, alteration or loss of relevant records
  • Witness interviews follow preparation, questioning, corroboration and contemporaneous note-taking
  • Root-cause analysis separates immediate errors from systemic control weaknesses
  • Investigation reports present facts, findings, recommendations and decision records

Participants can prepare controlled responses to inspections, requests and reportable events.

  • Notification decision trees test reportability, deadlines, approvals and legal advice
  • Regulator correspondence logs capture requests, commitments, submissions and due dates
  • Inspection protocols coordinate document retrieval, escorts, interviews and legal support
  • Voluntary disclosure decisions weigh legal duties, cooperation and remediation evidence
  • Management briefings present facts, exposure, response options and accountabilities
  • Post-inspection action tracking closes findings and verifies corrective actions

Participants can plan targeted compliance communications that support required behaviour and reporting.

  • Training needs analysis links legal duties to role-specific learning requirements
  • Role-based curricula differentiate frontline, manager, specialist and director responsibilities
  • Knowledge checks test understanding of prohibited conduct and escalation routes
  • Attestation processes record policy receipt, understanding and declared conflicts
  • Speak-up communications explain confidentiality, protection and investigation expectations
  • Culture indicators combine survey results, incident patterns and control observations

Participants can build a risk-based monitoring programme and report meaningful compliance information.

  • Annual monitoring plans prioritise high-risk obligations, controls and business units
  • Control testing scripts define population, sample, evidence and pass criteria
  • Thematic reviews identify recurring failures across processes and locations
  • Key risk indicators measure exposure, overdue actions and control exceptions
  • Management information distinguishes trends, incidents, findings and emerging risks
  • Dashboard design links metrics to decisions, ownership and escalation thresholds

Participants can coordinate assurance findings, corrective actions and formal management review.

  • Assurance maps coordinate legal, compliance, risk and internal audit coverage
  • Findings rated by legal severity, root cause and recurrence potential
  • Corrective action plans specify owners, milestones, evidence and validation criteria
  • Issue ageing reports identify overdue actions and ineffective remediation
  • Management review evaluates system suitability, resources, trends and improvement priorities
  • ISO 37301 review records document decisions, actions and follow-up responsibilities

Participants can build, review and present a complete compliance management pack for a defined business area.

  • Business scope defines entities, activities, jurisdictions and applicable legal duties
  • Legal obligation register identifies material requirements, owners and evidence
  • Compliance risk assessment ranks inherent risk, controls and residual exposure
  • Control matrix assigns preventive, detective and corrective control responsibilities
  • Monitoring plan schedules testing, indicators, reporting and management review
  • Implementation roadmap prioritises actions, dependencies, resources and target dates

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Legal obligation register template
  2. Compliance risk assessment model
  3. Risk and control matrix
  4. Regulatory change impact assessment template
  5. Compliance monitoring and reporting plan
  6. Compliance management pack

Who should attend

  • Compliance Manager — needs a repeatable system for statutory obligation management
  • Legal Counsel — needs to translate legal advice into owned operational controls
  • Risk Manager — needs to integrate compliance risks within enterprise risk reporting
  • Internal Auditor — needs to assess compliance control design and operating evidence
  • Operations Manager — needs to assign and evidence frontline regulatory responsibilities
  • Governance Officer — needs to support board oversight, reporting and accountability

Skills and tools covered

Legal obligation mappingCompliance risk assessmentControl designRegulatory change managementCompliance monitoringIncident investigation

Tools and standards

ISO 37301, ISO 31000, COSO ERM, Three Lines Model

How the course runs

Training methodology

The course uses short instructor briefings, guided analysis of statutes and regulator expectations, and case work based on realistic compliance failures. Participants build working documents progressively, including obligation registers, risk assessments, control matrices and reporting plans. Group exercises test judgement on conflicting duties, weak evidence, third-party exposure and reportable incidents. Simulations cover management review, internal investigations and regulator-facing decisions. Individual application planning connects each method to participants’ own legal duties, business processes and reporting lines.

Requirements and prerequisites

Participants should have basic workplace experience in legal, compliance, risk, audit, governance, operations, human resources, procurement or a regulated business function. They should be comfortable reading internal policies, process documents and management reports. Familiarity with their organisation’s sector, key regulators and major legal obligations is helpful, but detailed legal training is not assumed. Participants do not need to be lawyers, auditors or certified compliance professionals. The course does not require prior knowledge of ISO 37301, ISO 31000, COSO ERM or the Three Lines Model.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need general workplace experience in a relevant function such as compliance, legal, risk, audit, governance or operations. A law degree, audit qualification or prior knowledge of compliance standards is not required.

Participants should bring a laptop for document-building activities and, where permitted, examples of policies, risk registers, audit findings or regulatory obligations from their workplace. Sensitive material should be anonymised before use.

The course is designed for professionals with responsibility for legal duties, regulatory controls, policies, assurance or operational risk. It is also suitable for managers who own regulated processes but do not work in a dedicated compliance role.

Legal awareness courses explain legal subjects, while this course focuses on converting duties into owned controls, evidence, monitoring and reporting. Internal audit courses focus on independent assurance; this programme focuses on building and managing the first-line and compliance arrangements being assured.

Participants build reusable documents throughout the programme, beginning with obligation identification and risk assessment. The final compliance management pack can be adapted for a department, business unit, country operation or regulated service.

The programme contains 20 modules of about three contact hours each, taught over 10 instructor-led days from 08:30 to 16:30. Time is divided between technical briefings, case analysis, group work, simulations and development of workplace materials.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Legal