Regulatory Change Management Software Problems: The 7 That Cost You an Examination, and How to Avoid Them
The failure that costs firms most is not missing a rule. It is being unable to show the chain from the rule to a control that somebody owns and somebody tests. Eighteen months after an item was forwarded to a business line lead with a short note, a supervisor asks how the firm identified that requirement, who assessed it, what changed and how you know the change works. The honest answer is that the assessment happened in a conversation and the evidence sits in an archived mailbox belonging to someone who has moved departments. What follows is a finding, then a remediation programme run to a deadline you did not set, on top of the day job.
Why does the regulatory feed keep ending up in the scope?
Because it is the visible part. Someone opens a digest of forty to four hundred items every morning, most of them irrelevant, and concludes that the problem is the digest. So the requirement becomes a better feed: monitor these regulators, pull these publications, tag them our way.
That is the most expensive wrong turn in this category. Monitoring regulators across jurisdictions and normalising their publications is a permanent maintenance liability with no competitive upside, and the commercial providers do it well. Thomson Reuters Regulatory Intelligence and Wolters Kluwer OneSumX are strong at sourcing and alerting. Corlytics brings enforcement analytics and a serious taxonomy. Ascent works on generating obligations from rule text. RegEd is strong in licensing, registration and distribution compliance. Scraping a regulator's website yourself means owning every layout change forever, and the day it silently breaks is the day you stop receiving something you needed.
What none of them can ship is your firm's model of itself, and that is the whole build. They do not know that your Luxembourg entity holds one licence and your Singapore branch another, that you exited retail mortgages in 2023, or that control OP-114 in your register is the one that would have to change.
The scoping fix is a sentence you put in the brief before anyone quotes: we subscribe to the feed, we build the mapping. Then ask each developer to draw the model. Regulator, publication, lifecycle state, obligation with citation and version, footprint dimensions, control, policy, owner, assessment, implementation task, test, attestation. If they draw a document store with a workflow on top, they have misunderstood the problem entirely.
What goes wrong when you migrate an existing obligation register?
Most firms have a register, and most registers were built once as a project, usually after a finding. A consultant read the rulebook, produced two thousand rows, and the document was accurate for about a month. Nobody has trusted it since, and importing it wholesale imports the distrust along with the rows.
Three specific problems surface. Rows without citations, so when a publication amends the source text there is no way to identify which obligations are affected. Rows written at inconsistent altitude, where one entry covers an entire chapter and the next covers a single sentence, which makes control mapping meaningless. And mappings to controls that no longer exist because the control library was reorganised in the meantime.
The fix is to treat the register rebuild as compliance work with its own owner and its own timetable rather than as a data migration the developer absorbs. Import what carries a usable citation and a clear owner. For everything else, run a structured pass deciding whether each row becomes a real versioned obligation, gets merged into one, or is retired with a note. This is the critical path on most of these projects, and firms that already have a control library in usable condition move considerably faster than those building one from the rulebook. Say honestly which of the two you are before agreeing a timeline.
Why do the feed and platform integrations break after launch?
Three failure modes, and the first one is the quiet killer.
Silence. If a feed stops delivering, or a scheduled pull fails, an empty day looks exactly like a quiet day. There is no error and no alert, and the first sign of trouble is a requirement you never assessed. Every ingestion path needs an expectation attached to it: this source delivers on these days, and an absence raises an exception to a named person. Ask any developer what happens when nothing arrives, and treat a shrug as disqualifying.
Duplication and revision. Regulators reissue publications, providers restate items, and the same requirement arrives twice with different identifiers. A system that creates a second obligation each time produces a register that grows without becoming more complete, and analysts start dismissing items because they look familiar.
Taxonomy drift. Your provider's tags are theirs and they change. If your applicability rules are written against their tag names rather than against your own footprint dimensions, a vendor taxonomy update reroutes your alerts overnight. Map their tags into your model once, deliberately, and keep the translation in one place where a change is a small maintenance task rather than a mystery.
The same discipline applies to a policy management system or an existing governance platform. Ask what happens when a control is renamed or retired on the other side while obligations still point at it.
What happens when effective dates and model oversight are not covered?
These are the two gaps that turn a working system into one that still fails an examination.
Effective dates first. A rule is not an event, it is a lifecycle: discussion paper, consultation, final rule with a publication date, an effective date, sometimes a transition period, sometimes phased application by firm size. Teams assess at consultation, feel productive, and get caught eighteen months later by an enforceable date nobody diarised. If the system generates work from the publication date, it helps you assess and fails to help you comply. Model the lifecycle as dated states and generate forward dated work items from the effective date, so readiness reporting answers what becomes enforceable in the next two quarters rather than what happened last month.
Model oversight second, and this one is newer. If you use machine learning for relevance scoring, obligation extraction or similarity matching, and you should for exactly those three jobs, the record has to store both what the model proposed and what the human decided. Not just the outcome. Supervisors now ask how you oversee the model as well as how you oversee the process, and a system that silently discards low scoring items cannot answer that. Nothing the model produces is a determination. Every disposition carries a human name.
Both gaps have the same shape: the system captures the visible work and not the thing that is actually examined.
Should you build custom or configure what you already own?
Check your existing platform first, and mean it. If you already own an enterprise governance, risk and compliance system, find out whether your obligation register and control library can live inside it. Sometimes they can, and the build reduces to an ingestion and applicability layer, which is a much smaller project. The reason firms end up building separately is usually that the platform's taxonomy cannot express their footprint, not that it lacks storage. Establish which of those two you are facing before spending anything.
Do not build if you operate in one jurisdiction, hold one licence, and your compliance function is small enough that everyone already knows what is coming. A subscription, a shared register and disciplined meeting minutes is proportionate and a supervisor will accept it. Adding software to a team of two does not add assurance, it adds a system nobody has time to maintain.
Build when two or more of these are true. You operate across multiple jurisdictions or legal entities with different permissions. Your obligation register exists and nobody trusts it. You have had a supervisory finding or an internal audit issue on regulatory change management, which is by a wide margin the most common trigger. Your assessment trail lives in email. Or you are growing by acquisition, so the footprint changes faster than any manual process can track.
How do hidden costs get into the quote?
Five ways, and the biggest one is not engineering at all.
The initial obligation register build. This is compliance work, it sits on the critical path, and it gets assumed to be free because it does not look like software. Resource it explicitly with named people and a timetable, or the project will be blocked in week six waiting for content.
Jurisdictions and legal entities. Applicability logic scales with the footprint, so each additional entity with different permissions is more than a row in a table.
The condition of your control library. If controls are inconsistent, duplicated across business lines or documented in narrative rather than as discrete items, mapping is slow and frustrating regardless of the software.
Languages, if you operate where rules are published in more than one, which affects extraction and matching rather than just display.
And integration with a policy management system or an existing governance platform, which is priced as a connector and delivered as a data model negotiation. For anchoring, our bands: a first release covering the footprint model, the versioned obligation register, mapping to controls and policies, ingestion of one or two feeds and the assessment workflow runs $60,000 to $130,000 in ten to sixteen weeks. A full platform adding multiple jurisdictions with a shared theme taxonomy, lifecycle state tracking, attestation cycles, committee and board reporting and an examination evidence pack runs $150,000 to $350,000 across six to ten months.
What separates a build that works from one that fails here?
The footprint is modelled as data with effective dates, not as a filter someone applies. That is what turns relevance from an analyst's personal talent into a rule that survives them leaving, and it is the difference between a system that proposes a scoped item with an owner attached and one that hands over a blank page. Footprints change, so the dates matter: a rule that did not apply to you in 2024 may apply now.
Superseded obligations are handled explicitly. Ask what happens to the controls mapped to an obligation when an amended version supersedes it. The answer should involve version linkage and a review work item, not a silent remap. Getting this wrong is exactly how registers quietly rot, and it is invisible for about a year.
Themes cluster against your own taxonomy. Operational resilience, third party risk, consumer outcomes and financial crime controls arrive repeatedly from different regulators with different terminology. Clustering does not reduce the work, it improves the sequencing, because you discover that a control built for one jurisdiction already covers most of what another now demands and the gap analysis starts from something rather than nothing.
And ownership is settled in writing before kickoff. You hold the repository, the infrastructure accounts and the right to hire anyone else. This system is the evidence you hand a supervisor, and evidence you cannot access on your own terms is not evidence at all.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- McKinsey found that tech debt can amount to 20-40% of the value of a company's entire technology estate before depreciation, and CIOs report that 10-20% of the budget for new products is diverted to resolving tech-debt issues. Source: McKinsey & Company (2020) →
- The federal government spends about 80% of its IT budget on operations and maintenance of existing systems rather than on development or modernization, with many critical systems being decades old. Source: U.S. Government Accountability Office (GAO) (2025) →
- WordPress powers 41.5% of all websites and holds 59.2% of the market among sites running a known content management system, making it by far the most-used CMS on the web. Source: W3Techs (2026) →
- SMS reminders that stated the specific cost of the appointment to the health system reduced missed appointments in Trial One, with the DNA (did-not-attend) rate falling from 11.1% (control) to 8.4% (specific-costs message) - an odds ratio of 0.74 (95% CI 0.61-0.89), i.e. roughly a 24-26% relative reduction - at no additional cost. (Trial Two replicated this at an 8.2% DNA rate.). Source: PLOS ONE (Hallsworth et al.) (2015) →
Devon looks after direct to consumer accounts, where the store is the business and a bad checkout costs money the same day. He works with brands on commerce builds and site changes, and writes about what to prioritize when every request looks urgent.
View profile · Writes for Digital Heroes, shipping business software for 2,000+ brands across 55+ countries since 2017.
Frequently asked questions
Our analyst filters the daily digest by instinct. How do we turn that into rules?
Should we run relevance scoring on a model, given supervisors now ask about models?
What is the difference between an obligation and a control in this model?
Our register was built by a consultant two years ago. Is any of it salvageable?
How far ahead should the system be telling us about effective dates?
Can this live inside the governance platform we already pay for?
What does an examination evidence pack need to contain?
We are acquiring a firm in another jurisdiction. Does that change the build?
How do I know when spreadsheets are no longer enough to run my operations?
What does it cost to keep custom software running after launch?
At what point does Retool cost more than building a custom tool?
How many SaaS seats do we need before building custom becomes cheaper?
How much does a custom internal tool cost to build?
When does a company outgrow Airtable?
What tech stack should an internal tool be built with?
Does it matter which tech stack the agency wants to use?
Who can build a custom internal tools system?
Digital Heroes builds custom internal tools systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other internal tools companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
