The problem
Regulatory-change risk rarely arises only because an organisation failed to hear about a new rule. More often, the change was known but never converted into assigned responsibilities, decisions, documents and operating controls. A legal team may understand the amendment while contracts, policies and systems remain unchanged.
A management framework
- Monitor. Identify the official sources and regulators relevant to the business, and record publication, commencement and status.
- Classify. Distinguish enacted law, regulation, decision, circular, guidance and consultation draft: they do not have the same legal effect.
- Assess impact. Identify affected entities, processes, contracts, policies, data and people.
- Assign ownership. Give each action an owner, deadline, approver and verifiable outcome.
- Implement. Change documents, systems, training and controls, not merely the legal memorandum describing the rule.
- Evidence and review. Retain decisions and compliance evidence, then test the effectiveness of implementation after an appropriate period.
Questions to ask
- When does the instrument take effect, and are there transitional provisions?
- Who and what within the organisation is actually affected?
- Does the change require board or committee approval, or an update to a contract, policy or system?
- What evidence would demonstrate compliance to the competent authority?
- When should the instrument or regulator’s practice be checked again?
Official sources
See the sources listed with this article.