---
title: "Regulatory change management: horizon scanning and an obligations register for a lean firm"
canonical: https://www.grcmana.io/vault/compliance/regulatory-change-management
published: 2026-10-22
updated: 2026-10-23
author: "Harry West"
framework: "Compliance"
control: "Guide Regulatory change management: horizon scanning and an obligations register for a lean firm"
journeyStage: advanced
---

# Regulatory change management: horizon scanning and an obligations register for a lean firm

## Key takeaways

Regulatory change management is how a firm finds new or changed rules, decides whether they apply, assigns owners and deadlines, and updates its obligations, policies and controls in time. A small UK regulated firm can run it with one owner: scan named primary sources weekly, triage monthly, keep the obligations register as the system of record, and give the board a one-page summary each quarter.

- **FCA Handbook Notices** — The FCA publishes a Handbook Notice monthly, the day after its Board meets, summarising the instruments the Board has made.
- **Policy Statement** — An FCA Policy Statement follows a Consultation Paper once the consultation closes, responds to the feedback and contains the final legal instrument of Handbook rules.
- **Regulatory Initiatives Grid** — The Financial Services Regulatory Initiatives Forum's Grid sets out planned initiatives for the next 24 months, so firms can plan for those with significant operational impact.
- **DORA** — The Digital Operational Resilience Act sets ICT risk management, incident reporting and third-party risk rules for EU financial entities, and has applied since 17 January 2025.

The FCA has published a policy statement that changes a rule you rely on, and you found out from a client, not your own process. For a compliance officer at a UK regulated firm of 25 to 250 people, that is the real risk in regulatory change management: not the rule itself, but learning about it late.

Regulatory change management is how a firm spots new or changed rules, decides whether they apply, assigns owners and deadlines, and updates its obligations, policies and controls in time. For a small firm, scan named sources weekly, triage monthly, record outcomes in the obligations register and report a summary to the board each quarter.

This guide gives you that process in a form one person can run: the sources to scan, the triage questions, the register that holds it together, and what the board should see.

## What is regulatory change management?

Regulatory change management is the repeatable process a firm uses to find regulatory changes, judge which ones apply, plan the work, and prove the work was done. It sits inside the wider compliance function, alongside monitoring and reporting, and its output is an obligations register that stays current rather than a pile of saved alerts.

For how regulatory change fits with the rest of a compliance function, see our [compliance hub](https://www.grcmana.io/vault/compliance). The short version is that regulatory change management has three parts.

- **Horizon scanning** finds what is coming.
- **Triage and impact assessment** decide what it means for you.
- **Implementation and evidence** make the change real and show it happened.

The process below covers all three, so a scan ends in evidence, not a saved alert.

## Which sources should a small firm scan for regulatory change?

A small UK regulated firm should scan a fixed, named list of primary sources: the FCA's own publications, the Regulatory Initiatives Grid, the PRA if it is dual-regulated, the ICO and NCSC, Parliament for new legislation, and the EU Official Journal for any EU-regulated part of the group. A named list makes the scan repeatable and auditable.

The FCA publishes changes in a predictable pattern. Its [guide to what it publishes](https://www.fca.org.uk/what-we-publish/printable/print) says Consultation Papers "contain draft Handbook rules", that a Policy Statement "contains the final legal instrument", and that Handbook Notices are "published monthly (the day after our Board meets)". Every three months, a Quarterly Consultation Paper covers minor Handbook changes.

The [Regulatory Initiatives Grid](https://www.fca.org.uk/publications/corporate-documents/regulatory-initiatives-grid) is the best single view of what is coming. It "sets out the planned regulatory initiatives for the next 24 months" from a forum whose members include the FCA, the PRA, the Bank of England, the ICO and The Pensions Regulator. The 10th edition, published in May 2026, lists 135 live initiatives.

New legislation follows its own path. The government's collection page tracks the [Cyber Security and Resilience Bill](https://www.gov.uk/government/collections/cyber-security-and-resilience-bill), introduced to Parliament on 12 November 2025 to reform the NIS Regulations 2018 and still going through Parliament in October 2026. A Bill page belongs on the list as soon as the Bill could affect you, and its dates come from the Act once passed.

| Source | What it covers | Suggested cadence |
| --- | --- | --- |
| FCA Policy Statements and Consultation Papers | Final rules and proposed rules for the FCA Handbook | Weekly |
| FCA Handbook Notices | Instruments the FCA Board has made, summarised | Monthly, after each FCA Board |
| FCA Dear CEO letters | The FCA's expectations for firms | Weekly |
| Regulatory Initiatives Grid | Planned initiatives with significant operational impact over two years | Each new edition |
| PRA publications (dual-regulated firms, including insurers) | Prudential rules, supervisory statements and policy | Weekly |
| ICO (the Information Commission since 30 September 2026) | Data protection guidance and enforcement | Monthly |
| NCSC | Cyber security guidance and advisories | Monthly |
| UK government and Parliament | New UK legislation, such as the Cyber Security and Resilience Bill | Monthly |
| EU Official Journal (EUR-Lex) | EU regulations such as DORA, NIS2 and the EU AI Act, for EU-regulated entities | Monthly |

The cadences are our recommendation for a firm of this size, not a regulatory requirement. Adjust them to how often each source actually publishes something that touches your permissions.

A newsletter subscription is not a horizon-scanning process.

Newsletters and law firm briefings are useful for context, but they summarise the source on someone else's timetable. Scan the primary source, and use the briefing to understand it.

## How does the regulatory change management process work?

The regulatory change management process runs in seven steps: scan, triage, impact assessment, plan, implement, evidence and close. We recommend a weekly scan, monthly triage and planning, and a quarterly report to the board. Each change becomes one record that moves through the steps, so nothing depends on memory or a single inbox.

### 1. Scan

Each week, the owner works through the source list and logs anything new in a change log: the source, the date, a one-line summary and a link to the primary document. Logging takes minutes. Judging comes later, so the scan stays quick and nothing is dropped because it looked minor.

### 2. Triage

Once a month, the owner takes every logged item through three triage questions (set out in the next section) and gives it one of three outcomes: not applicable, monitor, or act. Record the reason for each outcome. A "not applicable" decision with a reason is evidence of good governance; one without a reason is a gap.

### 3. Impact assessment

For each "act" item, assess what changes in your firm. Which obligations are new or different? Which policies, processes, controls, systems, contracts and training does the change touch? Which teams are affected? Keep this short and factual. How serious a missed obligation would be is a separate question, covered in our guide to [compliance risk assessment](https://www.grcmana.io/vault/compliance/compliance-risk-assessment).

### 4. Plan

Turn the impact assessment into actions, each with a named owner and a deadline that sits ahead of the rule's effective date. Take the effective date from the primary source, such as the Policy Statement or the legislation itself, never from a summary.

### 5. Implement

Owners make the changes: update the policy, change the process, configure the control, brief the staff. The compliance owner tracks progress at the monthly meeting and escalates anything that will miss its deadline.

### 6. Evidence

For each action, keep the record that shows it was done: the approved policy version, the change ticket, the training completion report. Link each record to the change and to the obligation in the register.

### 7. Close

Close the change only when every action has evidence and the obligations register reflects the new position. Note the closure date, so the next review can confirm the change is still working.

A change without evidence is a promise, not a change.

## How do you triage a regulatory change?

Triage a regulatory change by asking three questions: does it apply to us, when does it take effect, and how much will it change what we do? The answers give each change an outcome (not applicable, monitor or act) and a priority, so the firm spends effort on the changes that matter and records why it set the others aside.

| Question | What to check | Typical outcome |
| --- | --- | --- |
| Does it apply to us? | Your permissions, products, customer types, legal entities and any EU-regulated part of the group | Not applicable, with the reason recorded |
| When does it take effect? | The effective date in the final rule or legislation; for proposals, the consultation close date | Monitor if it is still a proposal or more than a year away |
| What impact will it have? | Which obligations, policies, controls, systems and contracts change, and how many teams are involved | Act, with priority set by impact and time to the effective date |

The one-year line is our recommendation, not a regulatory rule: act sooner on any change that needs a system build or new contract terms. Proposals deserve a light touch. A Consultation Paper tells you what may change, so log it, note the close date and decide whether to respond. Act on the final Policy Statement or legislation.

Some changes reach you indirectly. DORA, [Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj), applies from 17 January 2025 to EU financial entities, and a UK firm that serves them may find its requirements arrive through a contract instead of a regulator. Treat a contract clause that carries a regulation as a regulatory change in its own right.

## What goes in an obligations register for regulatory change?

An obligations register is the record of what your firm must do, where each obligation comes from, who owns it, and how it is met. For regulatory change management, the register is the system of record: every closed change should leave the register more accurate than it was, with obligations linked to the policies, controls and evidence that meet them.

A register that only lists laws tells you what exists. A register that links each obligation to a control tells you whether you comply.

| Field | What it holds |
| --- | --- |
| Obligation ID | A unique reference for the obligation |
| Obligation | What the firm must do, in plain English, not copied rule text |
| Source | The rule, legislation or contract clause, with a link to the primary document |
| Applies to | The entity, product, process or team in scope |
| Owner | The named person accountable for meeting the obligation |
| Policies | The policies that state how the firm meets it |
| Controls | The controls that put it into practice |
| Evidence | Where the proof that the controls work is kept |
| Effective date | When the obligation took, or takes, effect |
| Last change | The most recent change record that touched this obligation, and its status |
| Next review | When the owner next confirms the entry is still accurate |

Write each obligation in your own words and link to the source. Rule text belongs in the FCA Handbook, not in your register, and a plain-English line is what an owner can act on.

Three fields make this a regulatory change register rather than a static list: Effective date, Last change and Next review. Together they show which entries a change touched and when each owner must look again. If you are building the register from scratch, including obligations that arrive through customer contracts, our guide to the [compliance management system](https://www.grcmana.io/vault/compliance/compliance-management-system) covers it.

The register links outwards. Each obligation points to its policies and controls, and each control points to its evidence. If you hold ISO 27001, the same structure supports [Annex A 5.31](https://www.grcmana.io/vault/iso-27001/annex-a-5-31-legal-statutory-regulatory-and-contractual-requirements), which covers identifying legal, statutory, regulatory and contractual requirements. If you are building the wider programme around the register, our guide to building a [compliance programme](https://www.grcmana.io/vault/compliance/compliance-programme) covers how it fits.

ISO 37301:2021, the international standard for compliance management systems, also treats identifying compliance obligations and keeping them current as a core activity. You do not need certification to borrow that discipline.

## How should you report regulatory change to the board?

Report regulatory change to the board once a quarter in a single page: the changes found, the triage outcomes, the actions open and overdue, and the changes coming in the next two quarters. The aim is a decision-ready summary, so the board can see that change is under control and step in where a deadline is at risk.

A useful quarterly summary covers five things.

1. **New changes this quarter**, with their triage outcome.
2. **Open actions**, with owner, deadline and status.
3. **Overdue actions**, with the reason and the recovery plan.
4. **The look-ahead**: material changes due in the next six months, drawn from the Regulatory Initiatives Grid and your monitor list.
5. **Decisions needed**, such as budget, resourcing or a risk the board must accept.

Keep the minutes. A board that has seen and challenged the summary each quarter is part of your evidence that regulatory change is governed, not just tracked.

## When is regulatory change management software worth it?

Regulatory change management software is worth considering when the volume of relevant change outgrows what one person can scan and triage each month, when several entities or jurisdictions are in scope, or when the board needs an audit trail a spreadsheet cannot give. For a single-entity UK firm of 25 to 250 people, start with a disciplined spreadsheet register.

Ask four questions before buying anything.

- **Volume.** Is the weekly scan regularly taking more than a few hours?
- **Scope.** Do you hold permissions in several jurisdictions, or run several regulated entities?
- **Traceability.** Can you show the path from a rule to an obligation, a control and its evidence today?
- **Ownership.** Is there someone who will maintain the tool's content every week?

Software can speed up the scan and keep the audit trail. It cannot decide what applies to your firm or who owns the response. If the process does not work on a spreadsheet, it rarely works better in a tool.

## What are the common mistakes in regulatory change management?

The common mistakes in regulatory change management are relying on briefings instead of primary sources, triaging without recording reasons, treating a policy update as the finish line, and keeping the change log apart from the obligations register. Each one leaves the firm unable to show its regulator that a change was found, judged and implemented in time.

- **Scanning by inbox.** Alerts from newsletters arrive whenever they arrive. A named source list with a weekly slot does not depend on anyone's inbox.
- **No reasons on "not applicable".** A dismissed change with no recorded reason looks the same as one that was missed.
- **Stopping at the policy.** Rewriting a policy does not change what staff do. The process, the control and the training have to change too, and each needs evidence.
- **Two lists that never meet.** A change log that does not update the obligations register leaves the register out of date the day the change closes.
- **Dates from summaries.** Effective dates in briefings can be wrong or out of date. Take them from the Policy Statement or the legislation.

An obligation with no owner is a risk nobody has accepted.

## Frequently asked questions

### What is the difference between regulatory change management and horizon scanning?

Horizon scanning is the first step of regulatory change management: finding new and proposed rules early. Regulatory change management is the whole process, from scan through triage, impact assessment, planning and implementation to evidence and closure. A firm can scan the horizon well and still fail to implement what it finds.

### How often should a small firm scan for regulatory change?

We recommend a weekly scan of the core sources, a monthly triage meeting and a quarterly board summary. Add an unscheduled review whenever the firm itself changes. A new permission, product, legal entity or large client contract can bring existing rules into scope that no scan would flag as new.

### Who should own regulatory change management in a small firm?

One named person should own the process, usually the compliance officer or the senior manager responsible for compliance oversight. That person runs the scan and triage. Each resulting action has its own owner in the business, because the people who run a process are the ones who can change it.

### Does regulatory change management cover data protection and cyber rules as well as FCA rules?

Yes. Changes from the ICO, the NCSC, new UK legislation such as the Cyber Security and Resilience Bill, and EU rules such as DORA or the [EU AI Act](https://www.grcmana.io/vault/eu-ai-act) can all create obligations for a regulated firm. Put every source that can create an obligation on your scan list.