Finding · F-IAQ2-CHG-02
Emergency changes without retrospective CAB approval
ClosedCHG-02 · Emergency changes are retrospectively approvedChange ManagementQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.8.32 · ITGC-CM-02 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-02
Emergency changes are retrospectively approved
Application
GitHub Enterprise Cloud · ServiceNow ITSM
mapped
Evidence · Q3
5 items
2 approved · 1 pending · 2 rejected
Test · Q3
Fail
TST-SOC2-CHG-02 · High confidence
Finding
F-IAQ2-CHG-02 · Medium
Closed
Action
Aditya Singh
REM-F-IAQ2-CHG-02 · Closed
Validation
Failed
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. 4 of 11 emergency changes in April-June had no retrospective CAB approval recorded.
Applications: GitHub Enterprise Cloud, ServiceNow ITSM.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Emergency label in GitHub was not linked to the ServiceNow CAB record.
Agreed action plan
Remediate: emergency changes without retrospective cab approval.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-CHG-02
- Owner (FPR)
- Aditya Singh
- Target date
- 31 Jul 2026
- Priority
- Medium
- Status
- Closed
- Validation
- Failed · planned 26 Sep 2026
Evidence for this control (7)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-024 | ServiceNow: Emergency CRs closed with PIR | CHG-02 | 5 Oct 2026 | Rejected | |
| Q2-EV-018 | GitHub Enterprise Cloud · screenshot (Q2) | CHG-02 | GitHub Enterprise Cloud | 21 Jun 2026 | Rejected |
| Q2-EV-019 | ServiceNow ITSM · system export (Q2) | CHG-02 | ServiceNow ITSM | 26 Jun 2026 | Rejected |
| RBI-REQ-016 | GitHub: Bypass merges have retrospective approval | CHG-02 | 8 Oct 2026 | Under review | |
| RBI-REQ-017 | ServiceNow: Emergency CRs closed with PIR | CHG-02 | 7 Oct 2026 | Rejected | |
| SOC2-REQ-022 | GitHub: Bypass merges have retrospective approval | CHG-02 | 8 Oct 2026 | Accepted | |
| SOC2-REQ-023 | ServiceNow: Emergency CRs closed with PIR | CHG-02 | 7 Oct 2026 | Accepted |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-SOC2-CHG-02 | CHG-02 · Emergency changes are retrospectively approved | Q3 2026 Unified Program Review | 3 Oct 2026 | Laura Bennett · Kestrel Assurance LLP | Fail | High |
| TST-Q2-CHG-02 | CHG-02 · Emergency changes are retrospectively approved | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |