Glossary term
Regulatory Change Management
Subject: Compliance and Regulation, Compliance Programme and Function
Regulatory change management is the process of tracking new and changing laws and rules, judging their impact on the business, and making the policy, process and system changes needed to comply by the deadline.
Explanation
Rules change constantly, and missing one can mean a breach without anyone doing anything differently. The process has several steps. Horizon scanning looks ahead at proposals, consultations and speeches to spot what is coming. Each change is logged, and the team judges whether it applies and who is affected. An impact assessment sets out what must change in policies, products, systems and training. Owners are given tasks with dates, progress is tracked to completion, and the obligations register is updated. Large firms use subscription feeds and workflow tools, and some use RegTech to match new text to internal controls. The work sits mainly in the compliance function, but the business owns the changes. A team that learns of a rule at the effective date ends up patching contracts and systems in a hurry, with the breach already running.
Example
A regulator publishes a consultation on new rules for outsourcing, to take effect in 18 months. The horizon-scanning team flags it and the compliance lead lists 40 supplier contracts that will need new clauses. The firm responds to the consultation, budgets for the contract review and schedules it so that all changes are complete before the effective date.
Not to be confused with
- Regulatory Impact Analysis (RIA)
- An RIA is done by the regulator to assess a proposed rule. Regulatory change management is the firm's response to rules once they emerge.