Finding · F-SOC2-01

Emergency changes deployed without timely CAB approval

ClosedCHG-02 · Emergency changes are retrospectively approvedChange ManagementQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low

Requirement to validation

Requirement
ISO-A.8.32 · ITGC-CM-02 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-02
Emergency changes are retrospectively approved
Application
GitHub Enterprise Cloud · ServiceNow ITSM
mapped
Evidence · Q3
5 items
2 approved · 1 pending · 2 rejected
Test · Q3
Fail
TST-SOC2-CHG-02 · High confidence
Finding
F-SOC2-01 · Medium
Closed
Action
Aditya Singh
REM-F-SOC2-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-09-19 in the 2026 SOC 2 Type II Audit (Kestrel Assurance LLP). Emergency changes deployed without timely CAB approval.
Applications: GitHub Enterprise Cloud, ServiceNow ITSM.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Emergency changes could be closed in GitHub without a linked CAB record.
Agreed action plan

Introduced GitHub 'emergency' label automation that blocks closure until CAB approval is linked; continuous monitoring test added. September population re-tested with no exceptions. Tracked as T-018 in Prismet Tasks.

Management response: Introduced GitHub 'emergency' label automation that blocks closure until CAB approval is linked; continuous monitoring test added. September population re-tested with no exceptions.

Action
REM-F-SOC2-01
Owner (FPR)
Aditya Singh
Target date
19 Oct 2026
Priority
Medium
Status
Closed
Validation
Validated · planned 3 Oct 2026

Evidence for this control (7)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ITGC-REQ-024ServiceNow: Emergency CRs closed with PIRCHG-025 Oct 2026Rejected
Q2-EV-018GitHub Enterprise Cloud · screenshot (Q2)CHG-02GitHub Enterprise Cloud21 Jun 2026Rejected
Q2-EV-019ServiceNow ITSM · system export (Q2)CHG-02ServiceNow ITSM26 Jun 2026Rejected
RBI-REQ-016GitHub: Bypass merges have retrospective approvalCHG-028 Oct 2026Under review
RBI-REQ-017ServiceNow: Emergency CRs closed with PIRCHG-027 Oct 2026Rejected
SOC2-REQ-022GitHub: Bypass merges have retrospective approvalCHG-028 Oct 2026Accepted
SOC2-REQ-023ServiceNow: Emergency CRs closed with PIRCHG-027 Oct 2026Accepted

Tests of this control (2)

Open list →
TestControlCycleTestedByResultConfidence
TST-SOC2-CHG-02CHG-02 · Emergency changes are retrospectively approvedQ3 2026 Unified Program Review3 Oct 2026Laura Bennett · Kestrel Assurance LLPFailHigh
TST-Q2-CHG-02CHG-02 · Emergency changes are retrospectively approvedQ2 2026 Unified Program Review18 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditFailHigh