Change Impact Assessment

What Is a Change Impact Assessment?

A change impact assessment (CIA) is a structured analysis that identifies every group of people, process, system, and cultural element that will be affected by a proposed change, quantifies the severity of that impact, and provides the evidence base for designing the change management plan. It answers four fundamental questions: Who is affected? How are they affected? How severely are they affected? And what support do they need to transition successfully?

In banking, change impact assessments are not optional — they are a governance expectation. Most financial institutions require a formal impact assessment as part of their change management framework, and internal audit will review whether assessments were conducted with appropriate rigour. Regulatory bodies such as the PRA and ECB expect banks to demonstrate that they have assessed and managed the people, process, and technology impacts of significant changes — particularly those affecting critical business services, regulatory reporting, or customer-facing operations.

The change impact assessment sits at the heart of the change management plan. Without it, every subsequent activity — stakeholder engagement, communication, training, resistance management — is based on assumptions rather than evidence. With it, the change manager can target interventions precisely where they are needed, allocate resources proportionally to the severity of impact, and provide senior leadership with a clear, evidence-based picture of the change challenge ahead.

The Four Dimensions of Impact

Every change in banking creates impact across four interconnected dimensions. A thorough assessment must examine each one:

People Impact

People impact considers how the change affects the individuals who perform the work. Key questions include:

• Role changes. Will people's roles change? Will responsibilities be added, removed, or restructured? In banking, a technology migration might mean that analysts who previously spent 80% of their time on manual data entry now spend 80% of their time on exception management — a fundamentally different role requiring different skills and behaviours.
• Headcount implications. Will the change result in role reductions, redeployments, or new hiring? Even if the net headcount remains the same, the redistribution of roles across teams can be deeply unsettling.
• Reporting line changes. Will the organisational structure change? Will people report to new managers? Will teams be merged, split, or relocated?
• Skills and competency requirements. What new skills will people need? This includes technical skills (learning a new system), process skills (following new workflows), and behavioural skills (working in new ways — for example, shifting from individual processing to team-based investigation).
• Working patterns. Will working hours, shift patterns, or locations change? In banking operations, a global process consolidation might move work from one time zone to another.
• Career impact. How does the change affect career paths, promotion opportunities, and professional development? A specialist role that is being automated may feel like a career dead end to the person performing it.

Process Impact

Process impact examines how the change affects the workflows, procedures, and operational processes that people follow. Key questions include:

• Workflow changes. Which processes are changing, and how? Are steps being added, removed, resequenced, or automated? In banking, even small process changes can have significant implications because of the control framework — a changed process step may require a new control, or an existing control may need to be redesigned.
• Handoff changes. Are the interfaces between teams or departments changing? In cross-functional banking processes (such as trade settlement, which involves front office, middle office, operations, and finance), handoff changes affect multiple teams simultaneously.
• Control and compliance changes. Do the process changes affect regulatory controls, reconciliation checkpoints, or segregation of duties? These changes require specific attention from the compliance function and may need regulatory notification.
• Volume and throughput changes. Will the new process handle different volumes? A new straight-through processing capability might dramatically increase throughput while reducing the need for manual intervention.
• Standard operating procedures. Which SOPs need to be rewritten? In banking, SOPs are often extensive and detailed — rewriting them is a significant effort that must be planned and resourced.

Technology Impact

Technology impact considers how the change affects the systems, tools, and technical infrastructure that people use. Key questions include:

• New systems. Are people being asked to learn an entirely new system? What is the learning curve? How different is it from the current system?
• System decommissioning. Are existing systems being retired? People often have deep familiarity with current systems, including workarounds and shortcuts that will be lost.
• Integration changes. Do the interfaces between systems change? In banking, where dozens of systems are interconnected through complex data flows, integration changes can have cascading effects.
• Data migration. Is data being migrated from old systems to new? Data migration in banking is particularly sensitive because of the regulatory requirement to maintain complete, accurate, and auditable transaction records.
• Access and permissions. Do user access profiles, permissions, or authentication methods change? In a regulated environment, access changes must go through formal approval processes.

Culture Impact

Culture impact is the most intangible but often the most powerful dimension. It examines how the change affects the unwritten rules, shared assumptions, and behavioural norms of the organisation. Key questions include:

• Decision-making. Does the change shift how decisions are made? For example, moving from manager-led approval to automated rules-based decisioning changes the power dynamics within a team.
• Ways of working. Does the change introduce new working norms — such as agile delivery, cross-functional teamwork, or data-driven decision-making — that conflict with the existing culture?
• Identity and expertise. Does the change challenge people's professional identity? In banking, where expertise in specific processes or systems is a key source of status and career progression, changes that devalue existing expertise can provoke strong emotional reactions.
• Trust and psychological safety. Does the change create anxiety about job security, career prospects, or personal competence? If so, the cultural impact will be significant regardless of the technical impact.

Impact Severity Scoring

Once the impacts have been identified across all four dimensions, each must be scored for severity. A standard three-point scale is typically used in banking:

Low impact. The change is minor and can be absorbed with standard communication and minimal additional support. Examples: a user interface redesign that moves buttons to new positions but maintains the same functionality; a process change that resequences two steps but does not change the nature of the work.

Medium impact. The change is noticeable and requires targeted communication, some additional training, and management attention. Examples: a new reporting tool that requires analysts to learn new data extraction techniques; a process change that introduces a new quality check requiring additional knowledge.

High impact. The change is fundamental and requires intensive support — comprehensive training, extended parallel running, dedicated coaching, and sustained management involvement. Examples: a complete system migration requiring analysts to learn an entirely new platform; a role restructuring that changes the core nature of people's daily work; a process transformation that replaces manual processing with automation.

Impact severity should be scored for each affected population group, not at the overall project level. A single change initiative may have Low impact on the technology team (who are gaining a better platform) but High impact on the operations team (who must learn entirely new workflows). Aggregating to a single score masks the populations that need the most support.

Change Readiness Assessment

While the impact assessment tells you how severely people will be affected, the readiness assessment tells you how well-prepared the organisation is to absorb the change. Readiness is influenced by several factors:

Leadership sponsorship. Is there active, visible sponsorship from a senior leader who has the authority and credibility to drive the change? Research from Prosci consistently finds that active executive sponsorship is the number one predictor of change success. In banking, sponsorship must come from someone with operational authority — a Chief Operating Officer, Head of Operations, or equivalent — not just the project sponsor from the technology function.

Change history. What is the organisation's track record with previous change? If the last three transformation programmes were painful, poorly managed, or failed to deliver promised benefits, people will approach the next one with scepticism and cynicism. Conversely, if recent changes have been well-managed and successful, there is a reservoir of trust that can be drawn upon.

Change capacity. How much other change is the organisation already absorbing? In banking, where regulatory, technology, and business change programmes often run simultaneously, there is a real risk of change saturation — the point at which people simply cannot absorb any more change, regardless of how well it is managed.

Organisational culture. Is the culture generally open to change, or is it conservative and tradition-bound? Banking operations teams that have been performing the same processes in the same way for many years will typically have lower readiness than teams that have been through recent modernisation.

Middle management capability. Can the first-line and middle managers who will be responsible for implementing the change at the team level actually deliver effective change management? Do they have the skills, confidence, and time? In banking, middle managers are often the weakest link — they are expected to manage change on top of their existing operational responsibilities, with little training or support.

Readiness is scored using a similar scale (Low, Medium, High) and combined with the impact severity to determine the overall change management intensity required. A High-impact change in a Low-readiness environment demands the most intensive change management effort. A Low-impact change in a High-readiness environment can be managed with lighter-touch interventions.

Building a Change Impact Matrix

The change impact matrix is the primary output of the assessment. It consolidates all findings into a structured format that guides every subsequent change management activity. A well-constructed matrix includes:

Each row represents a distinct population group that experiences the change differently. Each column captures a different dimension of impact. The final column — change management intensity — determines how much resource, effort, and attention each group requires.

This matrix becomes the foundation for every other change management artefact:

• Stakeholder engagement plans are built for the populations with the highest impact and lowest readiness.
• Communication plans are tailored to the specific concerns and information needs of each group.
• Training programmes are designed to close the specific capability gaps identified for each population.
• Resistance management strategies focus on the groups most likely to resist, based on the severity and nature of the impact.

Identifying Who Is Most Affected

Not all populations are affected equally, and the most effective change management targets resources where they are needed most. The impact assessment reveals the change hotspots — the populations that are experiencing the most severe, multidimensional impact and are therefore at the greatest risk of unsuccessful adoption.

In banking, the most affected populations are typically:

• Front-line operations staff whose daily workflows are being fundamentally redesigned
• Middle managers whose team structures, reporting relationships, or span of control is changing
• Subject matter experts whose deep expertise in the current system or process may be devalued by the change
• Staff in locations or functions that are being consolidated, relocated, or downsized

These populations require the most intensive change management — frequent communication, comprehensive training, dedicated coaching, and sustained management support throughout the transition.

Banking Example: Assessing the Impact of a New AML Transaction Monitoring Platform

A major international bank decided to replace its legacy AML transaction monitoring system with a new AI-powered platform. The programme affected approximately 200 analysts across three locations (London, Dublin, and Krakow), along with team leads, compliance officers, technology support staff, and the bank's regulatory relationships.

The change management team conducted a comprehensive change impact assessment over four weeks, using structured interviews, workshops, process walkthroughs, and analysis of training records and operational data. Here is what they found:

People impact was severe. The 200 analysts were divided into two groups: 120 Level 1 triage analysts and 80 Level 2 investigators. Level 1 analysts faced the highest people impact — their entire role was being redesigned. Under the current model, they manually reviewed every alert, applying a standard disposition checklist. Under the new model, the AI system would automatically disposition 60% of low-risk alerts, and analysts would focus on the remaining 40% — cases that required judgement, investigation, and contextual analysis. This was not just a system change; it was a fundamental transformation of what the role meant. Skills that had been valued — speed, consistency, checklist compliance — would be replaced by skills that had been less important — analytical judgement, investigative curiosity, and written narrative quality.

Level 2 investigators faced medium people impact. Their core investigative role remained similar, but the enriched case data provided by the AI system would change their starting point and workflow.

Team leads faced high people impact. The new operating model required fewer team leads (the span of control was increasing), and remaining leads needed to shift from supervising checklist compliance to coaching analytical judgement — a fundamentally different management skill.

Process impact was high. Every standard operating procedure for alert triage would need to be rewritten. The escalation pathways between Level 1 and Level 2 were being redesigned. The quality assurance sampling methodology was changing. The suspicious activity report (SAR) preparation process was being enhanced with new data fields. Across all teams, the assessment identified 47 SOPs that required rewriting and 12 new SOPs that needed to be created.

Technology impact was high for all analysts. Everyone was moving from a legacy system they had used for seven years to an entirely new platform with a different interface, different navigation, different data presentation, and different workflow management. The learning curve was estimated at 4-6 weeks to reach basic competency and 12 weeks to reach full proficiency.

Culture impact was high for Level 1 analysts and team leads. The existing culture valued speed and volume — the number of alerts dispositioned per hour was a key performance metric. The new culture would value quality and judgement — the accuracy and thoroughness of case analysis would replace volume as the primary metric. This was a fundamental shift in what "good performance" looked like.

Readiness was assessed as low. The bank had recently undergone a difficult technology migration in another department that had been poorly managed, resulting in widespread cynicism about transformation programmes. Senior sponsorship was strong (the Head of Financial Crime was personally committed), but middle management capability was weak — team leads had never received change management training and were already stretched managing day-to-day operations. Additionally, the Krakow team was simultaneously absorbing new hires from a recent expansion, creating change saturation.

The impact matrix revealed that the highest-risk population was the Level 1 triage analysts in Krakow — they faced high impact across all four dimensions, low readiness, and were dealing with concurrent organisational change. The change management team designed an intensified programme for this group, including a dedicated on-site change champion, additional training sessions, a peer buddy system pairing experienced analysts with new hires, and weekly check-in meetings with the local team lead and the London-based programme manager.

By identifying these critical populations early, the programme was able to allocate resources proportionally. Rather than delivering a one-size-fits-all communication and training programme, the change team designed differentiated interventions calibrated to each population's specific needs — saving resources where impact was low and concentrating effort where it was high.

In the next module, we will explore how to identify, map, and engage the stakeholders who will determine whether your change initiative succeeds or fails.