Test · TST-SOC2-CHG-02
CHG-02 · Emergency changes are retrospectively approved
FailQ3 2026 Unified Program ReviewTested 3 Oct 2026 by Laura Bennett · Kestrel Assurance LLP
Requirement to validation
Requirement
ISO-A.8.32 · ITGC-CM-02 · RBI-ITGRCA-2023-7.4 · SOC2-CC8.1
mapped
Policy
Change Management Policy
pol-change
Control
CHG-02
Emergency changes are retrospectively approved
Application
GitHub Enterprise Cloud · ServiceNow ITSM
mapped
Evidence · Q3
5 items
2 approved · 1 pending · 2 rejected
Test · Q3
Fail
TST-SOC2-CHG-02 · High confidence
Finding
F-SOC2-01 · Medium
Closed
Action
Aditya Singh
REM-F-SOC2-01 · Closed
Validation
Validated
as recorded
Procedure and result
- Procedure
- GitHub 'emergency' label + CAB review; continuous monitoring flags missing approvals. Tests: GitHub Enterprise Cloud: Bypass merges have retrospective approval; ServiceNow ITSM: Emergency CRs closed with PIR. Frequency on-demand.
- Sample
- 25 items sampled (reperformance)
- Expected
- Emergency changes deployed outside standard review are logged and retrospectively reviewed and approved by the Change Advisory Board within 2 business days.
- Observed
- 2 of 9 emergency changes lacked CAB approval in Jul–Aug; remediated, Sep sample passed — see F-SOC2-01.
- Confidence
- High
- Evidence
- SOC2-REQ-022SOC2-REQ-023