Change Management Controls

What It Is and Why It Matters

Change management controls are the policies, procedures, and mechanisms that govern how modifications to IT systems, applications, infrastructure, and configurations are requested, evaluated, approved, implemented, and reviewed. For the CISA exam, this is one of the most important control areas because unauthorized or poorly managed changes are a leading cause of system outages, security vulnerabilities, and data integrity issues.

A robust change management process ensures that all changes are planned, tested, authorized, documented, and reversible. It prevents unauthorized modifications from being introduced into production environments and provides an audit trail that allows auditors to verify compliance with organizational policies and regulatory requirements.

The concept aligns with frameworks such as ITIL (which defines change management as a core service management process), COBIT 2019 (BAI06: Manage Changes), and ISO 20000 (IT service management). Auditors use these frameworks as benchmarks when evaluating an organization's change management practices.

Key Concepts and Terminology

Change Management Process Steps

• Change Request: A formal submission describing the proposed change, its rationale, and expected impact. All changes, whether application updates, infrastructure modifications, or configuration adjustments, should begin with a documented request.
• Impact Assessment: Evaluating the potential effects of the change on systems, services, users, and security. This includes identifying dependencies and potential risks.
• Approval: Obtaining authorization from the appropriate authority, such as a Change Advisory Board (CAB) or designated change manager, before implementation proceeds.
• Testing: Verifying that the change works as intended in a non-production environment before it is applied to production systems.
• Implementation: Applying the approved and tested change to the production environment according to the implementation plan.
• Post-Implementation Review: Verifying that the change achieved its objectives, did not introduce unintended side effects, and was properly documented.

Types of Changes

• Standard Changes: Pre-approved, low-risk, routine changes that follow a well-established procedure (for example, applying a routine security patch). These do not require individual CAB approval.
• Normal Changes: Changes that go through the full change management process, including formal review and CAB approval.
• Emergency Changes: Urgent changes required to resolve critical incidents or address severe vulnerabilities. These follow an expedited approval process but still require documentation and retrospective review.

Separation of Duties

A fundamental control in change management is the separation of duties between those who develop changes and those who deploy them to production. Developers should not have the ability to move their own code into the production environment. This separation reduces the risk of unauthorized or untested changes being introduced.

Change Advisory Board (CAB)

The CAB is a group of stakeholders responsible for reviewing, evaluating, and approving or rejecting proposed changes. The CAB typically includes representatives from IT operations, development, security, and affected business units. Its composition may vary depending on the nature and scope of the change.

Rollback Planning

Every change should have a documented rollback plan that describes how to reverse the change if it fails or causes unexpected problems. The rollback plan should be tested where possible and should include criteria for triggering a rollback decision.

How This Appears on the CISA Exam

Change management is heavily tested on the CISA exam. Expect questions that:

• Ask what the most important control is when managing changes (separation of duties and formal approval processes are common correct answers).
• Present a scenario involving an emergency change and ask what additional steps should be taken afterward (retrospective documentation and review).
• Test your understanding of separation of duties, specifically that developers should not promote their own code to production.
• Evaluate whether a change management process is adequate based on missing steps (such as no testing or no rollback plan).
• Distinguish between standard, normal, and emergency changes and their respective approval requirements.

Study Tips

• Memorize the change management process steps in order: request, assess, approve, test, implement, review.
• Emphasize separation of duties as a critical control; this appears frequently on the exam.
• Understand emergency change procedures: expedited approval is acceptable, but post-implementation documentation and review are still mandatory.
• Know the role and composition of the Change Advisory Board.
• Practice identifying what is missing in a described change management process.

Related Subtopics

• Configuration management
• Patch management
• Release management
• Version control systems
• SDLC methodologies
• Separation of duties in IT operations