Rule Changes

A new publication reaches the compliance team with an authority, a source reference and an effective date. The Control Owner opens the rule change against the right organization and assessment. That link matters: reviewers need the actual assessment context when they decide whether the proposed implementation is ready. A draft can be prepared without presenting it as an approved plan.

The register separates work still being prepared from changes submitted for review. A rejected change stays visible with its decision history. Completion is recorded after the approved implementation work, so the team can distinguish an accepted plan from a completed one. Operations Overview helps the team monitor the review workload across authorized organizations.

• Source. Capture the authority and publication reference beside the organization that must respond.
• Impact. Use the linked assessment, its business unit and the affected control count to guide the review.
• Decision. Keep the revision and decision date with the change as it moves through review and completion.

Decide who receives publications, who chooses the affected organization and who owns the assessment. Agree how a source publication will be cited so different owners can find the same notice. Define when a revised draft is ready to submit and who may decide on it. These choices make the register useful across teams that hear about the same change at different times.

For a change effective next quarter, start by confirming the organization and the related assessment period. The Control Owner can record the source and estimate affected controls, then ask the Independent Assurance Reviewer to inspect the submitted revision. If the source or impact changes, identify the new revision before treating an earlier decision as current.

Take one rule change from draft through submission. Open its linked assessment and confirm that the organization and business unit describe the intended scope. Ask the reviewer to locate the cited publication and the assessment evidence without a separate email trail. Check that the decision record refers to the revision under review and the linked assessment. If it is returned or rejected, have the owner revise and resubmit. If approved, follow the plan until the status reflects completed work.

Where an operation receipt is recorded, compare its result and expected revision with the decision. Reconcile a failed result before treating the action as finished. This is also a useful rehearsal for changes with the same effective date across different organizations.

• Rule Change Board — Scan draft, submitted, approved, rejected and completed changes by status.
• Rule Review Queue — Open submitted changes that need an independent decision.
• Submitted Rule Changes — Compare upcoming effective dates and linked assessments.

See review a rule change and assessment planning.