Regulatory change impact assessment: the file an examiner reads

A regulatory change impact assessment records whether a new or changed rule applies, what it touches and who will do what by when, and it is the core of the file examiners read. Examiners look for evidence that each regulatory change was identified on time, judged correctly for whether it applies, traced to every policy, system and form it touches, owned, finished before its effective date and tested afterwards. They find that evidence by reading completed changes. The OCC's procedure says so directly: examiners review "the bank's completed consumer compliance-related change management activities", and the information to review "may include the bank's project management tracking records, applicable committee meeting minutes, adopted policies and procedures related to the change, and monitoring or audit reports". Accuracy in regulatory change management is therefore a property of the file. Botminds' Regulatory Change Management keeps that file for every item it reads, and the rest of this page uses one of them to show what a file that holds up looks like.

What is a regulatory change impact assessment?

It is the documented analysis that turns a published rule into the institution's own work: whether it applies, to which products, states and channels, which policies, procedures, controls, systems, forms, vendors and training it changes, what that will take, and who owns each piece. A Federal Reserve examiner's guidance frames it as the board's four questions: "What is this regulation/guidance?", "What is the impact on our institution? What products does it affect, if any? Do we require system upgrades?", "What is the estimated cost to implement the change", and "What is management's plan for implementing and monitoring compliance?" (Consumer Compliance Outlook).

The word "impact" is the one that is most often done thinly. An earlier piece by the same examiner lists what it covers: "Evaluate the impact to the bank's policies and procedures, software, vendors and internal controls" (Federal Reserve Bank of Minneapolis). A policy redline alone is half an assessment. The loan system table, the disclosure template the vendor maintains and the control that tests the new number are where a change fails in practice, and they are the parts examiners sample.

What do examiners look for in change management?

They look for a process that anticipates change and a trail that proves it worked on real changes. Since March 31, 2017, the FFIEC consumer compliance rating system has asked examiners to assess, under Board and Management Oversight, the "effectiveness of the institution's change management processes, including responding timely and satisfactorily to any variety of change, internal or external, to the institution." It is one of four oversight factors, and the rating table describes what each grade looks like.

The difference between a 1 and a 2 is in two words: "anticipates" and "after". A 1 sees the change coming and checks afterwards that it worked. Both are evidenced only by what was written at the time, not by a narrative written for the exam.

The CFPB's compliance management review asks the same question from the procedures side. Examiners "review processes for the identification of new regulatory requirements, changes in requirements, and planning for implementation", check that training "is updated proactively in advance of ... the effective date of new or changed consumer protection laws and regulations", and read board and committee minutes for coverage of compliance matters (CFPB examination manual). Where a CMS was reviewed before, they may rely on earlier conclusions and assess "only the changes to the current CMS program", which puts the change file at the centre of a repeat exam.

How to do a regulatory change impact assessment, step by step

Log the item, decide whether it applies and why, fix the scope, trace it to every place it lands, set owners and dates back from the effective date, and close with a retest. Each step leaves a dated record, and the order matters: a scope set before the tracing is done tends to miss the systems and forms. Here is how the steps divide in Botminds' Regulatory Change Management, where agents do the reading, tracing and tracking and named people take the decisions.

Formality can scale with the change. The same examiner's guidance distinguishes "minor and technical" changes, such as "updating the inflation adjustment for the higher-priced mortgage loan appraisal exemption", from major ones such as the TRID requirements (Consumer Compliance Outlook). A threshold update may need three lines and a retest; a new disclosure regime needs a project plan. Both need the verdict, the scope and the owner written down, because the minor ones are the ones nobody remembers deciding.

A regulatory change impact assessment template: seven parts that hold up

A defensible change file answers seven questions about each item: what it was, whether it applied and why, who decided the scope, what it touched, who owned each piece and by when, how it was closed and tested, and what the board heard. The annotated file at the top of this page answers them for one product on one rule in the solution's sample data, a fictional lender called Kestrel Bank that lends in nine states across seven products. The table below maps each part to the procedure that asks for it.

Two parts are most often missing in files built by email. The first is the reason for a "does not apply" verdict. A team that reads thirty alerts a day closes most of them with no note, and an examiner asking why a state bulletin was set aside gets a recollection, not a sentence. The second is the retest. Policies get reworded and tasks closed, but the evidence that the system now computes the new threshold correctly is often a separate email, if it exists at all.

Every item read, with its verdict and the reason, including the ones that did not apply

What should a not-applicable assessment include?

The item, the date it was read, a one-sentence reason tied to the footprint, and who or what made the call. A rule wrongly set aside is the failure that leaves no trace, so the decision not to act needs the same evidence as the decision to act. In the sample month, the agents read 918 items and three applied. Every one of the others carries a one-sentence reason: a Regulation CC change is "Deposit accounts only; no lending product", an insurance regulation is "Insurance product; not offered". Anyone can send an item for a second look, and a 5% sample of "does not apply" verdicts is re-read by a person each week.

The reasons are what make the verdicts testable. An auditor can pick twenty "does not apply" items from a quarter and check each reason against the bank's footprint in minutes. Without reasons, the same test means re-reading twenty rules from scratch. How the agents arrive at a verdict, and which verdicts they may never close, is set out in which change tasks agents can take.

Signed scope and quoted mappings: the parts examiners test

A scope decision is only evidence if it says who made it and what it covered. In the solution, the regulatory change lead confirms each change's scope with an electronic signature that states its meaning, in the sample case "scope reviewed and confirmed", together with the products, the states, the exclusions and the owners. The exclusion is as much a part of the decision as the inclusion: Kestrel's small business loans were struck out of scope and its auto loans reviewed with no change, and both are in the file.

One cell’s impact: the change, the quoted rule, what it touches, the owner and the tasks

Every mapping quotes both texts: the rule passage that drives it, with its citation, and the policy passage it changes. That is the difference between a claim ("this touches the high-cost policy") and evidence ("the rule says this; section 3.2 says that; here is the new wording"). It also shows the reviewer where to look if the mapping is wrong.

Scope confirmed at 08:14 and the notes moved to In progress

The cost of a file that does not hold up

Weak change management is rated, and in the worst cases ordered. When the FDIC amended its consent order against Discover Bank in April 2025, it listed the bank's failure to maintain a compliance management system, "including (a) board of directors (Board) and Bank management oversight and commitment, change management, comprehension, identification, and management of risk" among other elements (FDIC order). The underlying conduct was not a missed new rule; change management was one of several failures named. The order carried a $150 million penalty and at least $1.225 billion in restitution.

Examination practice has also shifted weight onto internal audit's evidence. The FDIC's manual says examiners "will not criticize a supervised financial institution for a 'violation' of supervisory guidance", citing instead violations of law and regulation (FDIC examination manual), so the file has to show the rule itself was met. And under the Federal Reserve's 2026 operating principles, examiners "should not perform their own duplicative validations of whether a firm has fully remediated" a finding unless internal audit has not validated it (Federal Reserve). A file internal audit can test is the one examiners will be able to rely on.

How does internal audit test regulatory change management?

By sampling finished changes and following each from publication to proof, and by checking coverage against an independent list of what was published. Testing a change process means picking finished changes and following each from publication to proof. In the solution, internal audit has read access to every item's verdict and reason, every scope signature, every redline approval and every closed task, and can export the trail for a period. The same test can be run on any process. These are the steps.

The people who sign at each step are covered in who is responsible for regulatory change management, and what happens when a gap in the file reaches an effective date in the consequences of non-compliance. To see a full change file, start from Regulatory Change Management.

Questions people ask

How long should regulatory change files be kept?

The exam manuals we cite set no single retention period for change files; keep them at least through the next examination that will review the period. The CFPB allows examiners to rely on earlier conclusions and review only what changed since, so the file for each period needs to survive until the next exam reads it.

Do examiners want a regulatory change policy, or evidence?

Both, but evidence decides the rating. The OCC procedure starts with policies and discussions with management, then reviews completed changes to see whether the process is "appropriate and functioning as intended". A good policy with thin files reads as a process on paper.

Who signs off a regulatory change impact assessment?

The scope is usually signed by the regulatory change lead or compliance officer, the wording of each changed policy by its owner, and significant changes are reported to a compliance or risk committee. What matters to an examiner is that each signature is recorded with its date and what it covered.

Does every regulatory change need a full impact assessment?

Every item needs a verdict and a reason; only the ones that apply need the rest, and the depth can scale with the change. The OCC expects the formality of change management to be commensurate with the bank's size, complexity and risk profile, which allows a short assessment for a technical update but not a missing one.

Is a spreadsheet tracker enough?

It can be, if it captures every item with a verdict and reason, names who signed the scope, links to the policies changed and the retests done, and cannot be silently edited. Most spreadsheets fail on the last point and on the reasons for setting items aside.