Model policy · version 1
Change Management
Decide which changes are material, review them before they ship, and give the sponsor bank the notice its agreement promises. This is the process an examiner checks when a product launched, a vendor switched, or a policy moved without the bank hearing about it first.
What’s in this policy12 sections · Change Management · Read the full policy
9Obligations · things you must do
21Evidence · records that prove it
1Monitoring · checks and deadlines
1Reporting · reports you must send
Does this apply to you?
Answer a few questions and each obligation is marked applies, likely, or needs more information.
Tell Leela about your companyHand over the whole policy
Every obligation in this policy, in one request.
What the policy requires
Automate
Leela can perform the work through your connected systems.
Monitor
Leela can watch for the trigger, keep the clock, and flag what is late.
Prepare for review
Leela can prepare the artifact and hand it to a person for review.
Human required
A person must do the work; Leela can track it and file the evidence.
TriggerEvent-driven · Each change request, within three business days of intake
EvidenceChange request form, Triage record
TriggerEvent-driven · Each material change, within five business days of triage
EvidenceCompliance review memo, Vendor due diligence file
TriggerEvent-driven · Each change after compliance review; five business days for low and medium, ten for high
EvidenceApproval record, Monthly low-impact summary to the CEO
TriggerEvent-driven · Each medium change ten business days ahead; each high change 30 business days ahead
EvidenceSponsor bank notice package, Bank response record
TriggerEvent-driven · Each new, changed, or terminated critical service provider; 30 days before signing, 60 days before terminating
EvidenceCritical service provider notice, Sponsor bank written approval, Termination notice
TriggerEvent-driven · Each bank-initiated modification, within ten business days of the bank’s notice
EvidenceBank modification notice and response, Implementation change request
TriggerEvent-driven · Each approved material change; validation due 30 days after implementation
EvidenceImplementation plan and test results, Post-implementation validation record
TriggerQuarterly · Log kept continuously; quarterly review to the CEO; annual board report; seven-year retention
EvidenceChange management log, Quarterly log review, Annual board report
TriggerEvent-driven · Each emergency change; approval within one business day, bank notice within one business day of implementation
EvidenceEmergency change record, Emergency bank notice, Root cause analysis