A rule change is not a compliance event until you can name the controls it moves.
Most horizon scanning ends in a summary and a distribution list. That produces awareness, not assurance. Each change here is decomposed into the requirement shift it forces, the evidence it stops accepting on the effective date, and the tests that must be re-run before the next attestation is signed. Where a change never became operative, that is stated plainly rather than carried forward as an obligation.
The line that costs institutions money
Evidence invalidated is the field nobody fills in
When a requirement tightens, the control usually survives and the evidence does not. An annual pack that satisfied a supervisor last cycle can become inadmissible on a single effective date, and the institution discovers it during an examination rather than during a change assessment. Read that field first.
Status
Impact
8 changes shown
Why it matters to the estate
Scope becomes a reconciliation exercise. An institution whose register understates critical functions now fails scope before a single test is executed.
scope-extendedC12Operational resilience- C12.01
- C12.02
- Requirement shift
- Test scope reconciles to the register of information; every critical or important function is either in scope or carries a written exclusion approved at the accountable level.
- Evidence invalidated
- Scoping memoranda that cite management judgement without a register reconciliation attached.
- Test consequence
- Re-run on the full population of critical functions. Sampling is not available: one unscoped critical function is itself the finding.
evidence-changeC11Third-party and outsourcing risk- C11.01
- Requirement shift
- Third-party participation in testing is evidenced by an executed clause with a named obligation to participate.
- Evidence invalidated
- Vendor correspondence and side letters expressing willingness to co-operate.
- Test consequence
- Contract-level inspection across all critical providers before the next cycle opens.
Client instances track the regimes attached to their licences and entities, with the diff raised against their own control set and evidence inventory rather than against a reference library.
Scope your regime set