Organizational Mixer Board – Requirements model

Organizational mixer board – requirements model

OMB Requirement Catalog (ORC)

A requirements model helps the organization translate strategy and mission into clear expectations regarding structure, roles, working methods, competencies, and support. As part of the organizational mix board, the model enables the organization to describe what the business needs to function well, both today and in the next phase of development. The requirements can be used to analyze the current situation, identify gaps, and prioritize changes without losing the overall perspective. For a Chief of Staff, the working method creates a common basis for dialogue between management, managers, and teams. It becomes easier to distinguish between real needs, desired solutions, and temporary symptoms. The article shows how the requirements model can be built, used, and monitored, as well as how it is linked to the other controls in the organizational mix board. With clear requirements, the organization can make more consistent decisions, allocate resources better, and create an organization that is efficient, adaptable, and ready to deliver over time. The model supports collaborative learning, responsibility, and continuous improvement throughout the entire organization in a sustainable way.

OMB 1–10 Governance and corporate governance

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
1Board responsibilityCompanies Act (2005:551) Chapter 8.TeamChairman of the BoardA
2CEO instructionCompanies Act (2005:551) Chapter 8, Section 29TeamBoard of DirectorsA
3Rules of Procedure for the BoardCompanies Act (2005:551), Chapter 8, Section 46TeamBoard of DirectorsA
4Delegation arrangementCompanies Act (2005:551), internal governance and controlTeam/GovernanceCEOB
5Internal controlCOSO Internal Control FrameworkStandard/GovernanceCFOC
6Risk managementISO 31000:2018 Risk ManagementStandardManagement teamC
7Compliance functionSwedish code for corporate governance, GRC practicesGovernanceCompliance OfficerC
8Code of ConductSwedish code for corporate governanceGovernanceHR/LegalC
9Whistle blowing systemAct (2021:890) on the protection of persons who report misconductTeamCompliance/LegalA
10Disagreements and conflicts of interestCompanies Act (2005:551), Chapter 8, Swedish Code of Corporate GovernanceTeam/GovernanceBoard of DirectorsB

Comment on the level of security

CodeMeaning
ADirect statutory requirement or statutory obligation
BLegal support combined with established practice
CStandard, governance or accepted best practice
DOrganizational-specific requirements

OMB 11–20 Accounting and financial reporting

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
11Accounting obligationAccounting Act (1999:1078) https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/bokforingslag-19991078_sfs-1999-1078TeamCFOA
12Continuous bookkeepingAccounting Act (1999:1078)TeamCFOA
13Annual reportAnnual reporting act (1995:1554) https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/arsredovisningslag-19951554_sfs-1995-1554TeamCFOA
14Group financial reportingAnnual reporting act (1995:1554)TeamCFOA
15Archiving of accounting informationAccounting Act (1999:1078)TeamCFOA
16Accounting systems and verificationsAccounting Act (1999:1078)TeamCFOA
17Cash flow reportIFRS / ÅRL (for some companies)Team/StandardCFOB
18RevisionsAudit report (2001:883) https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/revisorslag-2001883_sfs-2001-883TeamBoard/CFOA
19Internal reportingNot verifiedGovernanceCFOD
20Financial policyNot verifiedGovernanceCFOD

OMB 21–30 Tax and VAT

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
21VAT registrationValue-added tax law (2023:200) https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/mervardesskattelag-2023200_sfs-2023-200TeamCFO/TaxA
22VAT declarationValue-added tax law (2023:200)TeamCFO/TaxA
23Employer contributionsSocial Security Act (2000:980) https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/socialavgiftslag-2000980_sfs-2000-980TeamCFO/HRA
24Tax deductionsTax Procedure Act (2011:1244) https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/skatteforfarandelag-20111244_sfs-2011-1244TeamCFOA
25Income taxIncome Tax Act (1999:1229)TeamCFOA
26Benefit taxationIncome Tax Act (1999:1229)TeamHR/CFOA
27RepresentationGuidelines from the Tax AgencyPracticeCFOB
28Transfer PricingOECD TP Guidelines / Swedish tax legislationLaw/PracticeTaxB
29Energy taxesLegislation on energy taxTeamCFOB
30Tax auditTax Procedure Act (2011:1244)TeamCFOA

OMB 31–40 Labour Law

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
31Employment protectionLaw (1982:80) on employment protection https://www.riksdagen.se/sv/dokument-lagar/dokument/svensk-forfattningssamling/lag-198280-om-anstallningsskydd_sfs-1982-80TeamHRA
32Co-determinationAct (1976:580) on employee participationTeamHRA
33Working hoursWorking hours law (1982:673)TeamHRA
34VacationHoliday team (1977:480)TeamHRA
35DiscriminationAnti-discrimination Act (2008:567)TeamHRA
36Parental leaveParental leave law (1995:584)TeamHRA
37Collective agreementsCollective agreementsContractsHRA
38Recruitment processNot verifiedGovernanceHRD
39Competence developmentNot verifiedGovernanceHRD
40RehabilitationLabour law + Social Security ActTeamHRB

OMB 41–50 Occupational safety and health

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
41Systematic occupational health and safety work (SAM)Regulations of the Swedish Working Environment Authority AFS 2001:1RegulationsHR/HSEA
42Risk assessmentAFS 2001:1RegulationsHSEA
43Safety representativeWorkplace safety law (1977:1160)TeamHRA
44Security patrolsAFS 2001:1RegulationsHSEA
45ErgonomicsRegulations of the Swedish Working Environment AuthorityRegulationsHSEB
46NoiseRegulations of the Swedish Working Environment AuthorityRegulationsHSEB
47Chemical workplace hazardsRegulations of the Swedish Working Environment AuthorityRegulationsHSEB
48Organizational and social work environment (OSA)AFS 2015:4RegulationsHRA
49Discriminatory special treatmentAFS 2015:4RegulationsHRA
50Accident reportingWorkplace safety law (1977:1160)TeamHSEA

OMB 51–60 Data protection and GDPR

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
51GDPR complianceGDPR (EU 2016/679) https://eur-lex.europa.eu/eli/reg/2016/679/ojEU regulationDPOA
52Register listGDPR Article 30EU regulationDPOA
53Legal basisGDPR Article 6EU regulationDPO/Legal DepartmentA
54Registration extractGDPR Article 15EU regulationDPOA
55Right to deletionGDPR Article 17EU regulationDPOA
56Personal Data Processing AgreementGDPR Article 28EU regulationLawA
57Data protection officerGDPR Article 37EU regulationDPOA
58DPIAGDPR Article 35EU regulationDPOA
59Incident reportingGDPR Article 33EU regulationDPO/CISOA
60Third-country transfersGDPR Chapter VEU regulationDPOA

Important uncertainty marker

This OMB catalog is still:

  • A = High security: verified against the law/regulation.
  • B = Reasonably verified: rule/regulation but simplified mapping.
  • C = Standard/Governance.
  • D = Not verified or organization-specific.

The following groups will be evaluated according to the following principle:

  • Legal requirements = law, EU regulation, regulatory order or other normative requirement.
  • Standard/governance requirements ISO, COSO, COBIT, NIST, GRC practice or any other established governance principle.
  • Not verified = where no clear primary source can be directly linked to the requirement.

OMB 61–70 Occupational safety and health

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
61ErgonomicsThe Working Environment Act (1977:1160), the regulations of the Working Environment AgencyLegal requirementsHSE/HRA
62Load-bearing ergonomicsRegulations of the Swedish Working Environment AuthorityLegal requirementsHSEA
63Bull exposureRegulations of the Swedish Working Environment AuthorityLegal requirementsHSEA
64Chemical workplace hazardsRegulations of the Swedish Working Environment AuthorityLegal requirementsHSEA
65Protective equipmentThe Swedish Work Environment AuthorityLegal requirementsHSEA
66CollaborationThe Swedish Work Environment AuthorityLegal requirementsHSEB
67Security trainingLabour lawLegal requirementsHSEB
68Crisis support after an accidentThe Swedish Work Environment AuthorityLegal requirementsHRB
69First aidRegulations of the Swedish Working Environment AuthorityLegal requirementsHSEA
70Corporate health careWorkplace regulationsLegal requirementsHRB

OMB 71–80 Data protection

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
71Consent managementGDPRLegal requirementsDPOA
72Data processing agentGDPR Article 28Legal requirementsLawA
73Registration extractGDPR Article 15Legal requirementsDPOA
74Data portabilityGDPR Article 20Legal requirementsDPOA
75Correction of dataGDPR Article 16Legal requirementsDPOA
76DeletionGDPR Article 17Legal requirementsDPOA
77Data minimizationGDPR Article 5Legal requirementsDPOA
78Privacy by DesignGDPR Article 25Legal requirementsDPO/CIOA
79DPIAGDPR Article 35Legal requirementsDPOA
80Data protection officerGDPR Article 37Legal requirementsDPOA

OMB 81–90 Information security

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
81Information classificationISO 27001Standard/governance requirementsCISOC
82Authority controlISO 27001Standard/governance requirementsCISOC
83Identity & Access ManagementISO 27001Standard/governance requirementsCISOC
84Log managementISO 27001 / NIS2Standard/legal depending on sectorCISOB
85EncryptionISO 27001Standard/governance requirementsCISOC
86BackupISO 27001Standard/governance requirementsCIOC
87Multifactor authenticationNIS2 recommended practiceStandard/governance requirementsCISOC
88Security incidentsNIS2 / ISO 27035Legal requirements in extensive operationsCISOB
89Vulnerability scanningISO 27001Standard/governance requirementsCISOC
90Penetration testISO 27001/NISTStandard/governance requirementsCISOC

OMB 91–100 Information security continues.

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
91Supplier securityISO 27001 Annex AStandard/governance requirementsPurchasing/CISOC
92Cloud securityISO 27017Standard/governance requirementsCIOC
93Security architectureTOGAF / ISO 27001Standard/governance requirementsCIOD
94Hot analysisNIST CSFStandard/governance requirementsCISOC
95Security trainingISO 27001Standard/governance requirementsHR/CISOC
96Continuity ITISO 22301Standard/governance requirementsCIOC
97Disaster RecoveryISO 22301Standard/governance requirementsCIOC
98Security OperationsNIST CSFStandard/governance requirementsCISOD
99Threat IntelligenceNISTStandard/governance requirementsCISOD
100AI securityEU AI Act (under implementation)Legal requirements are under developmentCIO/CISOB

OMB 101–110 Contracts and Law

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
101Contract archiveThe Contracts Act (1915:218)Legal requirements/practiceLawB
102Contract follow-upNot verifiedGovernance requirementsLawD
103Customer agreementsThe Contracts ActLegal requirementsLawA
104Supplier agreementsThe Contracts ActLegal requirementsPurchasing/LegalA
105NDAThe Contracts ActLegal requirementsLawA
106Power of AttorneyThe Contracts ActLegal requirementsLawA
107Warranty conditionsThe Buying ActLegal requirementsLawA
108Limitation of liabilityContract lawLegal requirementsLawB
109Dispute resolutionThe Code of Judicial Procedure/ContractsLegal requirementsLawA
110Legal WatchNot verifiedGovernance requirementsChief Legal OfficerD

OMB 111–120 Business ethics

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
111Anti-corruption programCriminal CodeLegal requirementsComplianceA
112MutorCriminal Code Chapter 10Legal requirementsComplianceA
113RepresentationSkatteverket + BrBLegal requirementsCompliance/CFOB
114GiftsCriminal CodeLegal requirementsComplianceB
115Conflicts of interestCode for corporate governanceGovernance requirementsBoard of DirectorsC
116Agent managementOECD/GRCGovernance requirementsComplianceC
117SponsorshipGovernanceComplianceD 
118DonationsGovernanceComplianceD 
119Third-party due diligenceISO 37301Standard requirementsComplianceC
120WhistleblowingAct (2021:890)Legal requirementsComplianceA

OMB 121–130 ESG, sustainability and the environment

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
121CSRD reportingEU Directive 2022/2464 (CSRD) https://eur-lex.europa.euLegal requirementsCFO / ESG ManagerA
122ESRSEuropean Sustainability Reporting Standards https://www.efrag.orgLegal requirementsCFO / ESG ManagerA
123Climate reportingCSRD/ESRSLegal requirementsESG ChiefA
124Scope 1 emissionsGHG Protocol https://ghgprotocol.orgStandard/governance requirementsESG ChiefB
125Scope 2 emissionsGHG ProtocolStandard/governance requirementsESG ChiefB
126Scope 3 emissionsGHG ProtocolStandard/governance requirementsESG ChiefB
127Environmental policyISO 14001 https://www.iso.orgStandard/governance requirementsSustainability ManagerC
128Waste managementEnvironmental Act (1998:808) https://www.riksdagen.seLegal requirementsOperations ManagerA
129Chemical managementREACH regulation https://eur-lex.europa.euLegal requirementsHSEA
130Energy mappingAct (2014:266) on energy mapping in large companies https://www.riksdagen.seLegal requirements (affected companies)Property managerA

OMB 131–140 ESG continuation

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
131Supplier audit ESGCSRD/CSDDDLegal requirements are under developmentPurchasing ManagerB
132Human rightsOECD Guidelines https://www.oecd.orgStandard/governance requirementsESG ChiefC
133Child labor in the supplier chainOECD/ILO conventionsStandard/governance requirementsPurchasing ManagerC
134Water useISO 14001Standard/governance requirementsOperations ManagerC
135Biological diversityESRS E4Legal requirements for reporting obligationsESG ChiefB
136Sustainable financingSFDR regulation https://eur-lex.europa.euLegal requirements for financial actorsCFOB
137EU taxonomyEU Taxonomy Regulation https://eur-lex.europa.euLegal requirementsCFO / ESGA
138Climate analysisTCFD/ESRSStandard/governance requirementsRisk managerC
139ESG follow-upESRSLegal requirements (reporting companies)ESG ChiefB
140Sustainability managementRequires verificationGovernance requirementsManagement teamD

OMB 141–150 Quality management

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
141Quality policyISO 9001 https://www.iso.orgStandard/governance requirementsQuality managerC
142Quality goalsISO 9001Standard/governance requirementsQuality managerC
143Process mappingISO 9001Standard/governance requirementsCOOC
144Process ownershipISO 9001Standard/governance requirementsCOOC
145Deviation managementISO 9001Standard/governance requirementsQuality managerC
146Rotary drill analysisISO 9001Standard/governance requirementsQuality managerC
147Improvement managementISO 9001Standard/governance requirementsCOOC
148Customer complaintsISO 9001Standard/governance requirementsCustomer Service ManagerC
149Delivery qualityISO 9001Standard/governance requirementsCOOC
150Internal audit qualityISO 19011 https://www.iso.orgStandard/governance requirementsInternal auditC

OMB 151–160 Operational management

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
151Management reviewISO 9001Standard/governance requirementsCEOC
152KPI managementRequires verificationGovernance requirementsCOOD
153Competency managementISO 9001Standard/governance requirementsHuman Resources ManagerC
154Certification managementISO standardsStandard/governance requirementsQuality managerC
155Continuous improvement (PDCA)ISO 9001Standard/governance requirementsCOOC
156Change managementITIL / ISO 9001Standard/governance requirementsCIOC
157Configuration managementITILStandard/governance requirementsCIOC
158Release managementITILStandard/governance requirementsCIOC
159Document managementISO 9001Standard/governance requirementsQuality managerC
160Version managementRequires verificationGovernance requirementsCIOD

OMB 161–170 Strategy and business development

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
161Process follow-upISO 9001Standard/governance requirementsCOOC
162Service qualityISO 9001Standard/governance requirementsCOOC
163Lean ManagementRequires verificationGovernance requirementsCOOD
164Six SigmaRequires verificationGovernance requirementsCOOD
165Business architectureTOGAF (not a public standard)Standard/governance requirementsCIOD
166Goal managementRequires verificationGovernance requirementsManagement teamD
167Strategy monitoringRequires verificationGovernance requirementsCEOD
168Balanced ScorecardRequires verificationGovernance requirementsCFOD
169Capacity planningRequires verificationGovernance requirementsCOOD
170Performance managementRequires verificationGovernance requirementsManagement teamD

OMB 171–180 Supplier management and purchasing

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
171Purchasing policyRequires verificationGovernance requirementsPurchasing ManagerD
172Supplier approvalISO 9001Standard/governance requirementsPurchasing ManagerC
173Supplier evaluationISO 9001Standard/governance requirementsPurchasing ManagerC
174Supplier risk analysisISO 31000 https://www.iso.orgStandard/governance requirementsRisk managerC
175Single Source RiskRequires verificationGovernance requirementsPurchasing ManagerD
176Outsourcing managementRequires verificationGovernance requirementsCIO / PurchasingD
177SLA controlRequires verificationGovernance requirementsDelivery ManagerD
178Supplier auditISO 9001Standard/governance requirementsPurchasing ManagerC
179Stockpile readinessRequires verificationGovernance requirementsSupply ChainD
180Geopolitical risk analysisRequires verificationGovernance requirementsRisk managerD

OMB 181–190 Physical security

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
181Systematic fire protection work (SBA)Act (2003:778) on protection against accidents https://www.riksdagen.seLegal requirementsSecurity ManagerA
182Evacuation plansAct (2003:778) on protection against accidentsLegal requirementsSecurity ManagerA
183Fire drillsLSO/MSB guidance https://www.msb.seLegal requirements/practiceSecurity ManagerB
184Pass systemRequires verificationGovernance requirementsSecurity ManagerD
185Physical entitlement managementRequires verificationGovernance requirementsSecurity ManagerD
186Visitor managementRequires verificationGovernance requirementsSecurity ManagerD
187Burglar alarmRequires verificationGovernance requirementsSecurity ManagerD
188Rock protectionRequires verificationGovernance requirementsSecurity ManagerD
189Property maintenancePlanning and Construction Act (2010:900) https://www.riksdagen.seLegal requirementsProperty managerB
190Critical infrastructureSecurity Protection Act (2018:585) https://www.riksdagen.seLegal requirements for the affected businessesSecurity ManagerB

OMB 191–200 Continuity and resilience

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
191Continuity planISO 22301Standard/governance requirementsCOOC
192Disaster RecoveryISO 22301Standard/governance requirementsCIOC
193Crisis management organizationMSB guidelinesGovernance requirementsCEOC
194Crisis communicationMSB guidelinesGovernance requirementsCommunications ManagerC
195Incident managementISO 22301Standard requirementsCOOC
196Surveillance of the external environmentGovernance requirementsManagement teamD 
197Resilience analysisISO 22301Standard requirementsRisk ManagerC
198Scenario planningISO 31000 / GovernanceGovernance requirementsManagementC
199Critical dependenciesISO 22301Standard requirementsCOOC
200RiskaptitCOSO ERM / ISO 31000Governance requirementsBoard of DirectorsC

OMB 191–200 Continuity and resilience

OMB-IDRequirementsPrimary sourceTypeResponsibilitySecurity
191Continuity planISO 22301Standard/governance requirementsCOOC
192Disaster RecoveryISO 22301Standard/governance requirementsCIOC
193Crisis management organizationMSB guidelinesGovernance requirementsCEOC
194Crisis communicationMSB guidelinesGovernance requirementsCommunications ManagerC
195Incident managementISO 22301Standard requirementsCOOC
196Surveillance of the external environmentGovernance requirementsManagement teamD 
197Resilience analysisISO 22301Standard requirementsRisk ManagerC
198Scenario planningISO 31000 / GovernanceGovernance requirementsManagementC
199Critical dependenciesISO 22301Standard requirementsCOOC
200RiskaptitCOSO ERM / ISO 31000Governance requirementsBoard of DirectorsC

Important final note

The OMB catalog should be seen as a Preliminary reference model. Approximately:

  • 35–40 % of the lines are clear legal requirements.
  • 20–30 % are regulatory or prescriptive requirements.
  • 30–40 % is the standard, governance or best-practice requirement.

Go to the summary page->

Read more about the requirements model->


author avatar
Rolf Olsson Partner
Rolf Olsson is one of the founders of Chief of Staff Platform and specialist in business transformation, strategy implementation, and management support. Rolf has worked more than 40,000 hours as a consultant and writes about how the Chief of Staff role, modern governance, AI, and change management can help organizations increase their execution capabilities and create sustainable business results. Rolf has a degree in civil engineering, a master's degree in IT Management, and a PhD in Computer Science. Comments or remarks on this article can be emailed to: glossary@chiefofstaff.se