Control · CHG-01

Production code changes are peer-reviewed and approved

Change ManagementSOC 2 · ISO 27001 · ITGC · RBIRisk High

Requirement to validation

Requirement
ISO-A.8.32 · ITGC-CM-01 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-01
Production code changes are peer-reviewed and approved
Application
GitHub Enterprise Cloud · Meridian Customer Portal
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-CHG-01 · High confidence
Finding
F-IAQ2-CHG-01 · Medium
Closed
Action
Aditya Singh
REM-F-IAQ2-CHG-01 · Closed
Validation
Validated
as recorded

What should be true

All changes to production repositories merge only via pull request with at least one independent approval and passing CI checks; branch protection prevents direct pushes.

Requirements
ISO-A.8.32 A.8.32 · Change management
ITGC-CM-01 ITGC-CM-01 · Program changes are authorized, tested and approved before migration
RBI-ITGRCA-2023-7.4 RBI-ITGRCA-2023 §7.4 · Change and patch management — documented, approved and tested changes (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)
SOC2-CC8.1 CC8.1 · Authorizes, designs, tests, approves and implements changes
Policy
pol-change · Change Management Policy
Applications
GitHub Enterprise CloudMeridian Customer Portal
Third parties
—
Testing procedure
GitHub branch protection + CODEOWNERS + Actions deployment environments. Tests: GitHub Enterprise Cloud: Branch protection on default branches; GitHub Enterprise Cloud: Merged PRs approved by non-author; Meridian Customer Portal: Deployed build traces to approved PR. Frequency continuous.

Findings (1)

Open list →
FindingObservationControlApplicationsSeverityStatusOwnerActionValidation
F-IAQ2-CHG-01Portal changes merged without second reviewerCHG-01GitHub Enterprise Cloud, Meridian Customer PortalMediumClosedAditya SinghREM-F-IAQ2-CHG-01 · ClosedValidated

Evidence (11)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ITGC-REQ-020GitHub: Branch protection on default branchesCHG-017 Oct 2026Accepted
ITGC-REQ-021GitHub: Merged PRs approved by non-authorCHG-016 Oct 2026Accepted
ITGC-REQ-022Meridian Customer Portal: Deployed build traces to approved PRCHG-01Meridian Customer Portal5 Oct 2026Accepted
Q2-EV-016GitHub Enterprise Cloud · policy document (Q2)CHG-01GitHub Enterprise Cloud11 Jun 2026Accepted
Q2-EV-017Meridian Customer Portal · screenshot (Q2)CHG-01Meridian Customer Portal16 Jun 2026Rejected
RBI-REQ-013GitHub: Branch protection on default branchesCHG-019 Oct 2026Accepted
RBI-REQ-014GitHub: Merged PRs approved by non-authorCHG-018 Oct 2026Accepted
RBI-REQ-015Meridian Customer Portal: Deployed build traces to approved PRCHG-01Meridian Customer Portal7 Oct 2026Accepted
SOC2-REQ-019GitHub: Branch protection on default branchesCHG-019 Oct 2026Accepted
SOC2-REQ-020GitHub: Merged PRs approved by non-authorCHG-018 Oct 2026Accepted
SOC2-REQ-021Meridian Customer Portal: Deployed build traces to approved PRCHG-01Meridian Customer Portal7 Oct 2026Accepted

Tests (4)

Open list →
TestControlCycleTestedByResultConfidence
TST-RBI-CHG-01CHG-01 · Production code changes are peer-reviewed and approvedQ3 2026 Unified Program Review6 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell)PassHigh
TST-SOC2-CHG-01CHG-01 · Production code changes are peer-reviewed and approvedQ3 2026 Unified Program Review3 Oct 2026Laura Bennett · Kestrel Assurance LLPPassHigh
TST-ITGC-CHG-01CHG-01 · Production code changes are peer-reviewed and approvedQ3 2026 Unified Program Review2 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal AuditPassHigh
TST-Q2-CHG-01CHG-01 · Production code changes are peer-reviewed and approvedQ2 2026 Unified Program Review18 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditFailHigh