IT, data & continuous
Change Management Control
The structured process by which IT system changes (configuration, code, settings) are requested, reviewed, approved, implemented, and documented. Change management ensures changes do not introduce risks and that system and data integrity is maintained. Auditors verify that changes proceed only through authorized channels and include proper testing and approval trails.
Source: COSO Internal Control Framework 2013, ISO 27001, IIA GIAS 2024