Control · CHG-02

Emergency changes are retrospectively approved

Change ManagementSOC 2 · ISO 27001 · ITGC · RBIRisk High

Requirement to validation

Requirement
ISO-A.8.32 · ITGC-CM-02 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-02
Emergency changes are retrospectively approved
Application
GitHub Enterprise Cloud · ServiceNow ITSM
mapped
Evidence · Q3
5 items
2 approved · 1 pending · 2 rejected
Test · Q3
Fail
TST-SOC2-CHG-02 · High confidence
Finding
F-SOC2-01 · Medium
Closed
Action
Aditya Singh
REM-F-SOC2-01 · Closed
Validation
Validated
as recorded

What should be true

Emergency changes deployed outside standard review are logged and retrospectively reviewed and approved by the Change Advisory Board within 2 business days.

Requirements
ISO-A.8.32 A.8.32 · Change management
ITGC-CM-02 ITGC-CM-02 · Emergency changes are approved and reviewed post-implementation
RBI-ITGRCA-2023-7.4 RBI-ITGRCA-2023 §7.4 · Change and patch management — documented, approved and tested changes (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)
SOC2-CC8.1 CC8.1 · Authorizes, designs, tests, approves and implements changes
Policy
pol-change · Change Management Policy
Applications
GitHub Enterprise CloudServiceNow ITSM
Third parties
—
Testing procedure
GitHub 'emergency' label + CAB review; continuous monitoring flags missing approvals. Tests: GitHub Enterprise Cloud: Bypass merges have retrospective approval; ServiceNow ITSM: Emergency CRs closed with PIR. Frequency on-demand.

Findings (2)

Open list →
FindingObservationControlApplicationsSeverityStatusOwnerActionValidation
F-IAQ2-CHG-02Emergency changes without retrospective CAB approvalCHG-02GitHub Enterprise Cloud, ServiceNow ITSMMediumClosedAditya SinghREM-F-IAQ2-CHG-02 · ClosedFailed
F-SOC2-01Emergency changes deployed without timely CAB approvalCHG-02GitHub Enterprise Cloud, ServiceNow ITSMMediumClosedAditya SinghREM-F-SOC2-01 · ClosedValidated

Evidence (7)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ITGC-REQ-024ServiceNow: Emergency CRs closed with PIRCHG-025 Oct 2026Rejected
Q2-EV-018GitHub Enterprise Cloud · screenshot (Q2)CHG-02GitHub Enterprise Cloud21 Jun 2026Rejected
Q2-EV-019ServiceNow ITSM · system export (Q2)CHG-02ServiceNow ITSM26 Jun 2026Rejected
RBI-REQ-016GitHub: Bypass merges have retrospective approvalCHG-028 Oct 2026Under review
RBI-REQ-017ServiceNow: Emergency CRs closed with PIRCHG-027 Oct 2026Rejected
SOC2-REQ-022GitHub: Bypass merges have retrospective approvalCHG-028 Oct 2026Accepted
SOC2-REQ-023ServiceNow: Emergency CRs closed with PIRCHG-027 Oct 2026Accepted

Tests (2)

Open list →
TestControlCycleTestedByResultConfidence
TST-SOC2-CHG-02CHG-02 · Emergency changes are retrospectively approvedQ3 2026 Unified Program Review3 Oct 2026Laura Bennett · Kestrel Assurance LLPFailHigh
TST-Q2-CHG-02CHG-02 · Emergency changes are retrospectively approvedQ2 2026 Unified Program Review18 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditFailHigh