The Control Usually Exists: the Record Doesn't
Most institutions already have a change management process: someone approves changes before they go to production, and someone tests them after. The gap examiners find isn't the process itself. It's proving the process was followed consistently, for every change, over the full exam period.
A verbal "we always get sign-off" doesn't hold up next to a sampled change with no ticket, no approver, and no rollback plan on file.
What a Defensible Change Record Includes
- Request: what's changing, why, and who asked for it.
- Risk and impact: systems affected, and whether it touches anything customer-facing or regulated.
- Approval: who signed off, and evidence they had the authority to.
- Testing: what was validated before deployment, and by whom.
- Rollback plan: the specific steps to undo the change if it fails.
- Post-implementation review: confirmation the change worked as intended.
Emergency changes need the same trail, just compressed: a same-day approval and a required after-the-fact review, not an exemption from documentation.
Where This Breaks Down in Practice
The most common gap is vendor-managed or SaaS changes: patches and configuration updates the vendor pushes on their own schedule. Examiners still expect your institution to track what changed, when, and whether it was reviewed, even if you didn't perform the change yourself.
The second most common gap is scope: a change ticketing tool exists, but it's only used for major projects. Routine changes, such as firewall rule updates, permission changes, or server patching, skip the process entirely because they feel too small to bother with.
Keeping It Sustainable
Change management documentation fails when it's too heavy for routine work. A lightweight ticket template that captures the six items above, applied consistently even to small changes, will hold up far better under sampling than a detailed process that's only followed for the big ones.
Need a Second Look at Your Process?
If you're not sure your change records would hold up to a sample pull, reach out. We can help tighten the process before an examiner tests it for you.