The Control Usually Exists — the Record Doesn't
Most institutions already have a change management process: someone approves changes before they go to production, and someone tests them after. The gap examiners find isn't the process itself — it's proving the process was followed consistently, for every change, over the full exam period.
A verbal "we always get sign-off" doesn't hold up next to a sampled change with no ticket, no approver, and no rollback plan on file.
What a Defensible Change Record Includes
- Request: what's changing, why, and who asked for it.
- Risk and impact: systems affected, and whether it touches anything customer-facing or regulated.
- Approval: who signed off, and evidence they had the authority to.
- Testing: what was validated before deployment, and by whom.
- Rollback plan: the specific steps to undo the change if it fails.
- Post-implementation review: confirmation the change worked as intended.
Emergency changes need the same trail, just compressed — a same-day approval and a required after-the-fact review, not an exemption from documentation.
Where This Breaks Down in Practice
The most common gap is vendor-managed or SaaS changes: patches and configuration updates the vendor pushes on their own schedule. Examiners still expect your institution to track what changed, when, and whether it was reviewed — even if you didn't perform the change yourself.
The second most common gap is scope: a change ticketing tool exists, but it's only used for major projects. Routine changes — firewall rule updates, permission changes, server patching — skip the process entirely because they feel too small to bother with.
Keeping It Sustainable
Change management documentation fails when it's too heavy for routine work. A lightweight ticket template that captures the six items above, applied consistently even to small changes, will hold up far better under sampling than a detailed process that's only followed for the big ones.
Need a Second Look at Your Process?
If you're not sure your change records would hold up to a sample pull, reach out. We can help tighten the process before an examiner tests it for you.