Test · TST-Q2-CHG-01
CHG-01 · Production code changes are peer-reviewed and approved
FailQ2 2026 Unified Program ReviewTested 18 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.8.32 · ITGC-CM-01 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-01
Production code changes are peer-reviewed and approved
Application
GitHub Enterprise Cloud · Meridian Customer Portal
mapped
Evidence · Q3
9 items
9 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-CHG-01 · High confidence
Finding
F-IAQ2-CHG-01 · Medium
Closed
Action
Aditya Singh
REM-F-IAQ2-CHG-01 · Closed
Validation
Validated
as recorded
Procedure and result
- Procedure
- GitHub branch protection + CODEOWNERS + Actions deployment environments. Tests: GitHub Enterprise Cloud: Branch protection on default branches; GitHub Enterprise Cloud: Merged PRs approved by non-author; Meridian Customer Portal: Deployed build traces to approved PR. Frequency continuous.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- All changes to production repositories merge only via pull request with at least one independent approval and passing CI checks; branch protection prevents direct pushes.
- Observed
- Branch protection on the customer-portal repository allowed administrators to merge without review; 3 of 30 sampled pull requests had no approving review.
- Confidence
- High