Add a manual control
Human review may be essential, but it needs a clear queue, evidence and recovery path rather than another invisible responsibility.
D/06The rules changed.
The rules changed.
Your accountability didn't.
A new regulation, policy or assurance requirement has changed what the business must evidence and control. The systems still reflect yesterday's obligations.
Compliance has become an operational requirement.
Regulatory change is often treated as a reporting project. In practice, the required evidence may depend on how work is approved, recorded, corrected and retained across the whole operation.
If the systems cannot represent the new rule, people compensate with parallel records and manual checks. That may satisfy the first deadline while creating an assurance process that is expensive to run and difficult to trust.
The useful response connects the obligation to the real operational decision: who must know what, when they must act, what evidence must remain and how an exception is resolved.
The same event can create exposure or advantage.
The fear
The company is accountable for a system it cannot explain.
Evidence is assembled after the event, controls depend on manual vigilance and an incident exposes the gap between written policy and actual operation.
The ambition
Assurance becomes part of how the operation works.
The business can show which rule applied, who acted, what changed and how an exception was handled without reconstructing the story from several systems.
How the constraint shows up.
01
New evidence must be assembled from records with different owners and retention rules.
02
Policy changes require manual checks because the core system cannot represent the rule.
03
The business cannot reliably explain why an automated or operational decision was made.
04
Audit preparation depends on a small number of experienced people.
05
A vendor controls the timetable for a change the business is legally required to make.
06
Teams are creating shadow records to prove that the official system was followed.
A compliance spreadsheet can meet a date while increasing the underlying risk.
01
02
Wait for the vendor update
This may be proportionate when the commitment and scope are clear; it is dangerous when the compliance timetable is no longer yours.
03
Replace the whole platform
A replacement can be justified, but a deadline-driven migration may introduce more operational risk than a controlled boundary around the required capability.
Translate the rule into evidence, decisions and exceptions.
The legislation or policy defines the obligation. The systems decision should define how the operation fulfils and proves it without relying on reconstruction.
Q/01
Which decision, record or control has actually changed?
Q/02
What must be explainable to a customer, auditor or regulator?
Q/03
Where can people override the system, and what evidence should that create?
Q/04
Can a bounded change meet the obligation safely, or has the core platform become an unacceptable dependency?
The right answer may be to change the process, configure a product, integrate what you already have, modernise one part or build an owned capability. ORBN helps make that decision before it helps deliver it.
Own the evidence for the responsibility you cannot transfer.
The business does not need to build every compliance tool. It does need reliable access to the rules, records and change path behind the obligations carried in its name.
OWN / 01
The policy and business rules applied to operational decisions.
OWN / 02
The audit trail, data lineage and exception evidence needed to explain the result.
OWN / 03
The ability to adapt the control when interpretation, guidance or the operation changes.
Continue the decision.
What else changed?
What changed?Make the obligation
Make the obligation
operable and explainable.
Tell us what changed, what must be evidenced and where the current systems leave the business exposed. We will help frame a proportionate response.