Regulatory change impact and risk assessment