Why Severity Scoring Is the Foundation of Regulatory Prioritisation
In a typical week, the Regulatory Monitor AI may ingest 6 to 8 regulatory communications from various authorities. Of these, perhaps 2 require immediate action before month-end. Two more require policy updates within 90 days. Three are informational — they monitor a trend or consult on a future change. And one may be a clarification of an existing rule that requires no action whatsoever.
Without a severity scoring framework, the compliance team must make these priority judgements individually for each bulletin — a process that is time-consuming, inconsistent between team members, and prone to the bias of whichever bulletin was read most recently or most visibly. With a severity score, the team sees immediately which changes need the Board's attention, which need functional heads, and which can be handled by the compliance team's standard workflow.
The Severity Score: 7 Dimensions, One Number, One Decision Tier
The Severity Scale: 4 Tiers, Defined Escalation Paths
| Score Band | Severity Tier | Decision Authority | Response Timeline | Board Notification | Examples |
|---|---|---|---|---|---|
| 85–100 | Critical | MD + Board + CCO | Action plan within 24 hours | Emergency Board notification required | New capital adequacy norms; fundamental change to business model eligibility |
| 65–84 | High | CCO + All Function Heads | Action plan within 72 hours | Board Risk Committee at next meeting | This bulletin (score 78); major KYC / CIP change; new NPL / charge-off classification rule |
| 40–64 | Moderate | CCO + Relevant Function Head | Action plan within 1 week | Quarterly board compliance report | Reporting format change; minor policy clarification with process impact |
| Below 40 | Low | Compliance team | Register update within 2 weeks | Annual compliance report | Definitional clarification; advisory note; FAQ publication |
The Portfolio of Circulars: How the AI Scores Multiple Changes Simultaneously
The severity scoring framework is not applied to one bulletin in isolation. It is applied to every bulletin ingested by the Regulatory Monitor AI, producing a running priority-ranked list of all open regulatory changes across every applicable authority. The compliance team's dashboard shows — at any moment — the full stack of pending regulatory obligations ranked by severity, with their deadlines, their completion status, and the functions responsible for each.
This portfolio view is what transforms compliance from a reactive fire-fighting function into a managed programme. A compliance team that can see 18 open regulatory changes simultaneously, ranked by severity, with their completion status and deadline proximity, is a team that can plan its work, allocate its capacity, and give the Board an honest picture of compliance programme health — not just the emergency on today's agenda.
The Severity Score Is Not a Risk Reduction — It Is an Attention Allocation Tool
A compliance team that spends equal time on a date-format clarification and a fundamental collections conduct amendment is not being thorough — it is being inefficient in a way that creates risk. The severity score ensures that when a bulletin scores 78, the MD is briefed that day, the function heads have action plans the next day, and the Board is notified at the next committee meeting. And when a bulletin scores 28, it goes into the register, gets updated in the compliance programme, and receives the attention it deserves — proportionate, not panicked. That proportionality, consistently applied across every bulletin, is what a well-governed compliance function looks like from the outside.