Finding · F-IAQ2-CHG-01
Portal changes merged without second reviewer
ClosedCHG-01 · Production code changes are peer-reviewed and approvedChange ManagementQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.8.32 · ITGC-CM-01 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-01
Production code changes are peer-reviewed and approved
Application
GitHub Enterprise Cloud · Meridian Customer Portal
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-CHG-01 · High confidence
Finding
F-IAQ2-CHG-01 · Medium
Closed
Action
Aditya Singh
REM-F-IAQ2-CHG-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. Branch protection on the customer-portal repository allowed administrators to merge without review; 3 of 30 sampled pull requests had no approving review.
Applications: GitHub Enterprise Cloud, Meridian Customer Portal.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Repository administrators were exempt from the branch-protection rule.
Agreed action plan
Remediate: portal changes merged without second reviewer.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-CHG-01
- Owner (FPR)
- Aditya Singh
- Target date
- 31 Jul 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Validated · planned 26 Sep 2026
Evidence for this control (11)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-020 | GitHub: Branch protection on default branches | CHG-01 | 7 Oct 2026 | Accepted | |
| ITGC-REQ-021 | GitHub: Merged PRs approved by non-author | CHG-01 | 6 Oct 2026 | Accepted | |
| ITGC-REQ-022 | Meridian Customer Portal: Deployed build traces to approved PR | CHG-01 | Meridian Customer Portal | 5 Oct 2026 | Accepted |
| Q2-EV-016 | GitHub Enterprise Cloud · policy document (Q2) | CHG-01 | GitHub Enterprise Cloud | 11 Jun 2026 | Accepted |
| Q2-EV-017 | Meridian Customer Portal · screenshot (Q2) | CHG-01 | Meridian Customer Portal | 16 Jun 2026 | Rejected |
| RBI-REQ-013 | GitHub: Branch protection on default branches | CHG-01 | 9 Oct 2026 | Accepted | |
| RBI-REQ-014 | GitHub: Merged PRs approved by non-author | CHG-01 | 8 Oct 2026 | Accepted | |
| RBI-REQ-015 | Meridian Customer Portal: Deployed build traces to approved PR | CHG-01 | Meridian Customer Portal | 7 Oct 2026 | Accepted |
| SOC2-REQ-019 | GitHub: Branch protection on default branches | CHG-01 | 9 Oct 2026 | Accepted | |
| SOC2-REQ-020 | GitHub: Merged PRs approved by non-author | CHG-01 | 8 Oct 2026 | Accepted | |
| SOC2-REQ-021 | Meridian Customer Portal: Deployed build traces to approved PR | CHG-01 | Meridian Customer Portal | 7 Oct 2026 | Accepted |
Tests of this control (4)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-CHG-01 | CHG-01 · Production code changes are peer-reviewed and approved | Q3 2026 Unified Program Review | 6 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-SOC2-CHG-01 | CHG-01 · Production code changes are peer-reviewed and approved | Q3 2026 Unified Program Review | 3 Oct 2026 | Laura Bennett · Kestrel Assurance LLP | Pass | High |
| TST-ITGC-CHG-01 | CHG-01 · Production code changes are peer-reviewed and approved | Q3 2026 Unified Program Review | 2 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Pass | High |
| TST-Q2-CHG-01 | CHG-01 · Production code changes are peer-reviewed and approved | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |