In financial services, IT change management is one of the areas examiners test most consistently, and one of the areas where findings come back year after year. Healthcare organizations face similar scrutiny from auditors.
The reason is simple. Change management is not judged on whether changes work. It is judged on whether the organization can show, after the fact, that each change followed the process it says it follows. Most technology teams make changes carefully. Far fewer can prove it from the record alone.
What examiners actually look at
A typical review starts with a sample. The examiner asks for a list of changes made during a period, picks a set of them, and asks to see the record for each one. For every change in the sample, they generally expect to find:
- A documented request and a description of what was changing and why.
- An assessment of the risk and the systems affected.
- Approval from the right person, recorded before the change was made.
- Evidence that the change was tested.
- Separation between the person who built the change and the person who put it into production.
- A review afterward confirming the change did what it was supposed to do.
None of this is unusual. The difficulty is having all of it, for every change in the sample, in a form someone outside the team can follow.
Where the gaps usually are
The same patterns show up across organizations of very different sizes.
- Approvals recorded after the change was already made.
- Emergency changes used as a routine shortcut, with no review afterward.
- Tickets that say testing was done but contain no evidence of it.
- The same person writing, approving, and deploying a change, with nothing recorded to compensate for it.
- Changes made by vendors, or directly in cloud consoles, that never pass through the process at all.
- Evidence that exists, but is scattered across email, chat, and personal folders.
Each of these is understandable on a busy week. Together they produce a record that cannot be defended.
Building a process that holds up
1. Sort changes into tiers
Define what counts as a change. Standard changes that are low risk and repeatable can be preapproved. Normal changes go through full review. Emergency changes are allowed, but each one is reviewed and approved after the fact, and the number of them is watched.
2. Approve inside the change tool
Make the approval happen in the system of record, not in an email that someone has to find later. If the approval is not in the record, for examination purposes it did not happen.
3. Attach evidence at the time
A screenshot or test result saved when the work is done takes a minute. Reconstructing it months later can take days.
4. Separate duties, or document why you cannot
Where the team is large enough, the person who builds a change should not be the one who deploys it. Where it is not, which is common in smaller organizations, document a compensating control, such as a second person reviewing changes after deployment, and make sure that review leaves a record.
5. Bring vendor and cloud changes into scope
Contracts should require vendors to follow the process or report their changes, and cloud environments should log changes so they can be matched to approved requests.
6. Reconcile every month
Compare what actually changed in key systems against the approved change records. Anything that changed without a ticket is the finding an examiner would have found. It is better to find it first.
A simple test
Pick ten changes from last quarter. For each one, try to answer every question above using only the record, without asking anyone who worked on it. If that takes more than a few minutes per change, or depends on someone’s memory, an examiner will reach the same conclusion.
The good news is that change management findings are among the most fixable there are. The process usually exists already. What is missing is the habit of leaving a record that proves it was followed.
System Custom Consultants works with financial services and healthcare organizations to strengthen the processes and records that examiners and auditors review. If change management keeps coming back as a finding, start a conversation at systemcustom.com.
