ISO 19600 Section 4 5 Identification of Obligations and Evaluation of Compliance Risk 

Organizations are required to systematically identify their compliance obligations along with the implications they have on their operations, products and services. Understanding the nature of these obligations and what is needed to meet them is essential to establishing an effective compliance program and contending with compliance risk.