Topic starter
06/11/2026 6:40 pm
TL;DR: Nexis says teams can create and manage their own compliance requirements and regulations directly in the UI, then attach controls, questions and descriptions so they appear in the Compliance module and support maturity assessments. The governance challenge is less about building a catalogue and more about keeping custom controls consistent, reviewable and auditable alongside standard frameworks.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Build Your Own Compliance Framework”.
Key questions
Q: How do teams govern custom compliance requirements without creating control sprawl?
A: Teams govern custom compliance requirements by mapping each requirement to a named control owner, a clear control objective, and a standard evidence test.
Q: When should organisations separate custom requirements from standard catalogues?
A: Organisations should separate custom requirements from standard catalogues when a rule is unique to one regulatory obligation, client contract, or risk exception and does not fit a reusable baseline control.
Practitioner guidance
- Define ownership for custom controls Assign a named owner, reviewer and approval path to every custom requirement before it enters assessment use.
- Standardise control descriptions Write each control description and question set so different assessors can score it consistently without interpretation gaps.
- Separate local flexibility from governed change Use a formal change process for additions, edits and retirements so the compliance catalogue stays auditable over time.
Bottom line: Custom compliance frameworks create value only when they are governed as first-class compliance objects rather than local shortcuts.
What to expect at the briefing
Nexis's full event briefing covers the operational detail this post intentionally leaves for the source:
- Live walkthrough of creating custom requirements directly in the UI
- How questions and descriptions are attached to new controls
- Where custom requirements appear inside the Compliance module
- How those controls feed maturity assessments
👉 Read Nexis's session on building custom compliance frameworks in the UI →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Custom compliance content is a governance object, not just a configuration choice. The moment teams create their own requirements, they inherit a responsibility to define ownership, review cadence and assessment consistency. If those controls are treated as local shortcuts, the programme gains flexibility but loses comparability. The right lens is not whether users can add controls, but whether the organisation can still trust the resulting maturity picture.
A question worth separating out:
Q: What is the best way to keep compliance evidence auditable as frameworks change?
A: The best way to keep compliance evidence auditable as frameworks change is to store evidence against control objectives, not just framework labels, and maintain traceability from each requirement to the underlying artefact. Version control, immutable timestamps, and a controlled mapping between old and new frameworks preserve continuity when controls are renamed or reorganised.
👉 Read our full editorial: Custom compliance frameworks in the UI for GRC teams