A regulatory change becomes operational only when someone can explain which entity it affects, what must change, who is responsible and what evidence will demonstrate completion. Circulating a document to several departments provides awareness, but it leaves those decisions unanswered. A useful implementation plan makes the reasoning and the remaining uncertainty visible together.
This worked example follows Illustrative Finance Ltd, a fictional NBFC, as it assesses an invented circular called FC-07. The circular, clause numbers, dates and implementation expectations are teaching assumptions, not RBI requirements. The example shows how to record a defensible process without pretending that a spreadsheet can interpret law. Banks can apply the same record structure while replacing the entity profile and source requirements with their own.
Start with the exact source and entity
On 18 September 2026, the compliance analyst opens a change record for FC-07 version 1. The source copy is preserved with its receipt date and a link to the controlled repository. The analyst records the legal entity, its servicing activity and the business permissions relevant to the assessment. A press summary or forwarded message would be insufficient to establish the exact wording being evaluated.
For real work, the RBI Master Directions directory provides a starting point for locating relevant directions, but the institution still needs the applicable text, amendments and commencement provisions.[1] The record should identify precisely what was reviewed. Here, the source field deliberately says Fictional circular so that an example cannot be mistaken for an actual regulatory instruction. The organisation should also assign someone to monitor later clarifications, rather than treating the first assessment as permanently settled.
Three clauses three decisions
The analyst separates three questions. RC-007-A concerns retention of independent servicing review evidence and is applicable within the fictional scope. RC-007-B concerns a deposit-only activity that the case entity does not undertake. RC-007-C contains transitional wording whose treatment of legacy records remains uncertain. These conclusions belong in separate rows because their rationale, actions and reviewers differ.
Applicable does not automatically mean deficient. The assessment must compare the requirement with the existing control before creating work. Equally, not applicable needs a reason and a review trigger. The deposit conclusion is supported by the case entity profile and should be revisited if its permissions or business change. Under review is a legitimate temporary state, provided it has an owner and a follow-up date. It must not disappear into an overall green completion label when other clauses are resolved.
| Clause | Case conclusion | Required follow-up |
|---|---|---|
| RC-007-A | Applicable to servicing | ACT-01 procedure; ACT-02 operating test |
| RC-007-B | Not applicable to this entity | Retain deposit-business rationale |
| RC-007-C | Under review | Resolve transitional question SQ-01 |
Establish the gap before choosing a solution
For RC-007-A, the servicing team demonstrates an existing queue and a procedure requiring independent review. The gap is narrower than an absence of control: the queue does not consistently assign cover when the reviewer is absent, and the evidence link can be omitted. The team records those facts before suggesting a system change.
This distinction affects both cost and testing. Buying or rebuilding an entire workflow would not automatically resolve the observed weakness. The proposed response is to define a cover-reviewer arrangement, require a retrievable review record and test whether the revised queue works across relevant servicing cases. A precise gap statement also gives the reviewer something to challenge. If the source text requires additional outcomes beyond evidence retention, those outcomes need their own assessment rather than an assumption that one procedural change satisfies everything.
Build responsibility into each action
The implementation plan creates ACT-01 to approve the revised queue procedure and ACT-02 to test its operation. The servicing lead owns the procedure. An operations control lead owns the operating test. Each action has a separate reviewer, a dependency and an original target date. The workbook therefore acts as a practical responsibility matrix as well as a task list.
The owner is accountable for producing the result; the reviewer evaluates whether the agreed criteria are met. A distribution list is not an owner, and a reviewer copied on an email has not necessarily approved anything. The team records the actual approval authority in the retained plan evidence. Small institutions may need proportionate arrangements, but the record should still explain how challenge is preserved when staff hold several roles. Responsibility remains clear even if a supplier performs part of the implementation.
Separate plan approval from completed implementation
On 21 September, the relevant case authority approves PLAN-01 for confirmed scope. That decision authorises the proposed actions and resources; it does not assert that the controls already work. The approval reference is linked to both actions so later reviewers can distinguish the approved design from subsequent completion evidence.
ACT-01 is reviewed and closed on 24 September with procedure version 2 retained as EV-01. ACT-02 remains in progress at the 30 September reporting date, with an original target of 5 October. A manager reading the workbook can therefore see that the plan is approved, the procedure has changed and operating verification remains outstanding. Combining these states into a single Implemented field would remove useful information. The evidence needed for design approval is different from the evidence needed to demonstrate use over a defined population and period.
Keep unresolved interpretation in the plan
RC-007-C remains under review. The compliance lead owns scope query SQ-01 with a follow-up target of 2 October. The team records the exact question, the competing interpretations and the information needed to resolve it. It does not convert uncertainty into a convenient not-applicable decision or leave the row without a responsible person.
Pending clarification, management considers whether interim controls are needed for legacy records and records that consideration separately. A query to an adviser or authority does not itself suspend a binding obligation. Any decision to proceed, limit implementation or adopt a temporary treatment needs an authorised rationale appropriate to the actual requirement. In the fictional case, confirmed actions can continue while the transitional question is investigated. The reporting pack explicitly labels the approved scope as partial, avoiding an unsupported statement that the entire circular has been implemented.
Define what the operating test must show
ACT-02 begins with a test plan that identifies the post-change population, relevant dates, absence-cover cases and expected evidence. The reviewer needs to see that the queue includes the relevant servicing records, that review is performed by the authorised person and that supporting records can be retrieved. A screenshot of an empty configuration screen would demonstrate very little about operation.
The team agrees the selection rationale before testing and records exclusions. This example does not prescribe a universal sample size. The actual approach should reflect risk, volume, control frequency and the nature of available evidence. If exceptions appear, the record should distinguish a defective design, inconsistent execution and a missing record. Each can call for different corrective work. The reviewer then explains how the findings affect the completion decision rather than relying on a checklist tick alone.
Preserve dates and manage dependencies
The action tracker retains the original due date and provides a separate approved revised date. An extension should have an authority, reason and approval reference. Quietly replacing the original date removes the ability to understand delay. Calendar days overdue are calculated against the revised date only when one has actually been approved and entered.
At the example reporting date, ACT-02 is not overdue. That does not prove it is on course. The team still needs the test population and reviewer availability, both recorded as dependencies. A useful discussion asks whether those inputs will arrive early enough to complete the work, and who will escalate a delay. For a genuine regulatory effective date, an internal extension cannot alter the external obligation. Keep internal delivery targets, external dates and approved management decisions distinguishable in the supporting record.
Adapt the process for banks and NBFCs
A bank may need several businesses, branches or subsidiaries to contribute to a change assessment. The record should identify which legal entity is responsible and where a common system change affects several entities differently. A group policy can coordinate implementation, but it cannot substitute for entity-specific applicability reasoning or approval responsibilities.
An NBFC should assess its category, layer, permissions and activities before applying a source to its operations. A focused team may use fewer workflow stages, provided the decisions and evidence remain identifiable. Basel compliance guidance supplies banking context for an effective compliance function, not a universal organisational chart or an automatic domestic requirement for every NBFC.[2] Both types of institution benefit from preserving the distinction between source interpretation, management implementation and independent challenge. The format should serve those decisions rather than force every change into identical documentation.
Use the workbook as a review record
The downloadable workbook separates the applicability assessment from implementation actions and includes blank and completed fictional sheets. Start by replacing the case material with a verified source and entity profile. Update the as-of date, record the rationale for each clause, and link applicable gaps to actions. Keep supporting evidence in the institution’s controlled repository.
The spreadsheet flags missing decisions, duplicate identifiers and certain incomplete closure records. A Record populated result confirms only that expected fields have entries. It does not validate legal interpretation or evidence quality. Before closing the change, ask whether every relevant clause has a reasoned conclusion, every required action has been tested and every unresolved question has a continuing owner. The lasting value of the record is that another person can reconstruct what was decided, on what basis, and what still needs attention.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 13 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.