[OR] [RBI] [7] Change Management

Change Management

The RBI’s guidance emphasizes the critical importance of effective change management in mitigating operational risks.

Financial institutions must establish a comprehensive change management process that involves all relevant departments and is supported by adequate resources. This process should thoroughly assess potential risks associated with changes, such as new products, systems, or markets.

Principle 7: Comprehensive Change Management

Senior management ensures a robust, well-resourced change management process effectively coordinated across different organizational levels.

Change Impact Assessment

Product, service, market, process, or technology changes can significantly impact an organization's operational risk profile.

Therefore, change management should comprehensively assess potential risks throughout the lifecycle, from inception to termination.

Policy and Procedure Framework

Financial institutions must have clear policies and procedures in place for managing change.

These should define roles and responsibilities, establish objective criteria for decision-making, and outline processes for monitoring change implementation.

Three Lines of Defence

The change management process should adhere to the three lines of defence model:

• First Line. Business units are responsible for initial risk assessments and managing change.
• Second Line. Risk management functions provide oversight, challenge business assessments, and monitor change implementation.
• Third Line. Internal audit independently reviews the change management process.

Review and Approval Process

A rigorous review and approval process is essential for new products, services, or changes to existing operations. This process should consider inherent risks, impact on the risk profile, necessary controls, and residual risk.

Resource Allocation and Monitoring

Adequate resources, including human capital and technology, must be allocated to support change initiatives.

Monitoring is crucial to identify deviations from expected outcomes and manage emerging risks.

Central Recordkeeping

Maintaining a centralized record of products and services facilitates change tracking and impact assessment.

Operational Resilience

Change management should contribute to operational resilience by assessing the potential impact of changes on critical operations and their interdependencies.

Financial institutions can mitigate operational risks, enhance business performance, and protect their reputation by effectively managing change.

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.