Emergency change post-review

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the emergency-change procedure; confirm it defines the 5-day retrospective approval window and the approving authority.PR.PS-06
2. 2.Confirm the change tooling flags emergency changes for post-review rather than relying on manual tracking.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 emergency changes from the period and confirm retrospective approval was completed within 5 days.
2. 2.Confirm changes without a timely retrospective approval were escalated.PR.PS-06
3. 3.Verify no sampled emergency change was later rejected without a documented remediation.

Linked risks

• Core platform obsolescencemitigation 1
• Change management failuremitigation 2

Framework mappings & latest test