Compliance Calendar: What to Include, Who Owns It and a Free Template

TL;DR

• A compliance calendar is one schedule of every regulatory filing, licence renewal, audit, policy review and training deadline the company must meet, with a named owner and a reminder for each.
• The dates are the easy part. Most of them are public, such as the Delaware franchise tax due March 1 (corp.delaware.gov) or Form 5500 due the last day of the seventh month after the plan year ends (irs.gov).
• Calendars fail in two ways: a filing whose owner left or never existed, and a business date, such as a product launch, set before the legal or privacy review it depends on has closed.
• Sentra joins the calendar and the HRIS with what people say in email, chat and meetings, and raises an ownerless filing or a launch that is ahead of its review to the right person with the evidence. A named person approves before anything goes out.

What is a compliance calendar?

A compliance calendar is a dated register of the obligations an organization must meet to stay compliant, showing what is due, to which authority, by when, and who is responsible. It covers statutory filings and tax returns, licence and permit renewals, certification and internal audits, board and policy reviews, and mandatory training.

Diligent describes it as a way to track deadlines for regulations, reporting obligations, filings, permits and licences, so stakeholders can see what is coming and who is preparing it. The value is in the owner and the lead time, not the date. A deadline with no owner is a deadline someone will discover after it passes.

A compliance calendar is not a GRC platform or a policy library. It is the operating schedule that sits on top of them. Many companies run it in a spreadsheet, a shared calendar or a task tool. The format matters less than the fields and the review habit.

What to put in a compliance calendar

Start with these categories. Each company's list depends on its jurisdictions, industry and whether it is public or private.

Corporate and statutory filings

• Annual corporate reports and franchise taxes. A Delaware corporation's annual report and franchise tax are due on or before March 1, with a $200 penalty plus 1.5% interest per month for late filing (corp.delaware.gov).
• UK Companies House. A confirmation statement can be filed up to 14 days after the end of the review period (gov.uk). A private company has 9 months from the end of its accounting reference period to deliver accounts, with late penalties from £150 to £1,500, doubled for two late years in a row (gov.uk).
• SEC periodic reports (public companies). Form 10-K is due 60, 75 or 90 days after year end and Form 10-Q 40 or 45 days after quarter end, depending on filer status (sec.gov).

Payroll, tax and benefits

• Form W-2 and W-3 to the Social Security Administration, and copies to employees, by January 31. Form 941 quarterly on April 30, July 31, October 31 and January 31. Form 940 by January 31 (irs.gov).
• Form 5500 for employee benefit plans by the last day of the seventh month after the plan year ends, July 31 for a calendar-year plan, with extensions requested on Form 5558 (irs.gov).

Licences, permits and certifications

• Business, professional and regulatory licences by jurisdiction.
• Insurance renewals, which often need updated risk information weeks in advance.
• Security and quality certifications, such as SOC 2 reports and ISO surveillance audits, on the cycle your auditor or certification body sets.

Privacy and data protection

• Reviews of the record of processing activities and privacy notices.
• Data protection impact assessments. Under GDPR Article 35 a DPIA is required before processing that is likely to result in a high risk to individuals (gdpr-info.eu). That makes it a launch dependency, not a once-a-year task.
• Response deadlines for individual rights requests, which run per request. See the DSAR guide.

Internal controls, governance and HR

• Board and committee meetings, and the papers due before them.
• Policy reviews (code of conduct, information security, AI use), access reviews and segregation of duties checks.
• Mandatory training completion and certification renewals. Testlify suggests grouping HR tasks into monthly, quarterly, bi-annual and annual cadences, with owners and backups.

Contract-driven dates

• Auto-renewal notice dates, price review dates and SLA reporting obligations. These are compliance dates too, and they live in contracts rather than statutes. The contract compliance guide covers them.

Compliance calendar template

Use one row per obligation per occurrence. Recurring items get a row for each due date so status can be tracked separately. The example rows assume a US calendar-year company with a UK subsidiary; adjust every date to your own facts.

*When a deadline falls on a weekend or holiday, the IRS date moves. January 31, 2027 is a Sunday, and the IRS draft 2026 W-2 instructions give February 1, 2027 as the due date (irs.gov).

How to use the fields

• Owner and backup. Name people, not teams. When the owner leaves, the backup holds the item until it is reassigned. Check owners against the HRIS each quarter.
• Lead time. The work starts when the lead time begins, not when the reminder fires. A 10-week accounts process with a 7-day reminder is already late.
• Depends on. Record what must close first, such as an audit sign-off, a legal review or a DPIA. A due date is only realistic if its dependencies close in time.
• Evidence. Store the filing receipt or sign-off. The calendar becomes your proof of compliance.

Worked example: two misses the calendar did not show

Assumptions, illustrative: a US company with a UK subsidiary, 600 employees, calendar-year plan for its 401(k), product launch planned for 3 November.

The filing with no owner. The Form 5500 row lists the HR director as owner. The HR director left in May. The HRIS shows the departure. The calendar still shows the name. The benefits broker emails the old address in June asking for the plan audit data, and the message is never answered. On 31 July the filing is due and no extension has been requested. Two systems held the facts, the HRIS and the inbox, and the calendar held neither.

The launch ahead of its review. In a September planning meeting, product sets a 3 November launch for a feature that profiles customer usage to target offers. The privacy lead flagged in a chat thread in August that this needs a DPIA, and legal's review is still open with questions on the vendor contract. The launch date is in the product roadmap. The open review is in legal's tracker and a chat thread. Neither system knows about the other.

Article 35 requires the DPIA before high-risk processing begins (gdpr-info.eu). The launch date is two weeks out and the review has no close date. The fix is cheap now: move the date, narrow the feature, or staff the review. After launch it is a remediation.

Both misses share a cause. The obligation and the reason it will slip live in different places: a calendar row, an HR record, an email, a meeting decision. A calendar only stores dates. It does not notice when the facts behind a row change.

Common compliance calendar mistakes

• Owners who have left. The most common failure. Reconcile owners with the HRIS on a schedule, and on every leaver; see the employee offboarding checklist.
• Reminders without lead time. A reminder 3 days before a filing that takes 3 weeks is not a reminder.
• No dependencies. Filings depend on audits, launches depend on reviews. Record them, or the calendar shows green until the day it turns red.
• One-off obligations missing. Launch reviews, new-market registrations and contract notice dates rarely make it into a calendar built from statutes.
• Calendars per team. Finance, HR, legal and security each keep their own. Nobody sees the whole year or the clashes in it.
• No evidence kept. If you cannot show the receipt, you cannot show you filed.
• Never reviewed. Rules change. Review the full list at least once a year and whenever you enter a new jurisdiction.

How Sentra catches this automatically

A compliance calendar tells you what is due. It cannot tell you that the owner left, that the broker's email went unanswered, or that a launch was set in a meeting before legal finished its review. Those facts sit in the HRIS, in inboxes and in meetings.

Sentra reads email, chat, meetings and documents alongside ERP, HRIS and CRM data. It joins each calendar obligation to the people and work behind it. When an owner on the calendar has left according to the HRIS, Sentra raises the ownerless filing to the person who should reassign it, with the deadline, the lead time and the unanswered messages attached. When a launch date set in a meeting falls before an open legal or privacy review is due to close, Sentra raises the conflict to the launch owner and the reviewer, with the meeting, the review thread and the dates.

Sentra knows when a fact became true and when it stopped being true, so a reassigned owner or a moved launch date replaces the old one instead of sitting beside it. A named person approves anything Sentra raises before it reaches anyone else, and Sentra never files, sends or changes a date on its own. Every answer respects each source's existing permissions. Sentra holds SOC 2 Type II and ISO 27001, runs in the cloud, an isolated VPC or air-gapped on-prem, and works alongside your calendar, GRC and task tools rather than replacing them.

To see Sentra find the ownerless filing before the due date, book a demo.

How to start a compliance calendar

1. Inventory obligations by jurisdiction and entity. Ask finance, HR, legal, security and operations for every recurring filing, renewal and review. Check each against the authority's own site.

2. Create one row per occurrence with the template fields above.

3. Assign a named owner and a backup to every row, and confirm each person is still employed and agrees.

4. Set lead times and three reminders per row, working back from the effort needed, not the due date.

5. Record dependencies, especially audits, reviews and data that other teams supply.

6. Review monthly with the owners, and run a full refresh each year and on any new entity, market or product line.

FAQ