Change Control

Change control is how mature organisations touch running systems deliberately: every modification to production — code, configuration, infrastructure — is proposed, assessed for risk, approved by the right authority, and recorded. It sounds like bureaucracy until the day an unapproved 'small tweak' takes down the system that runs the business.

What It Is

Change control (or change management in the ITIL sense) is the process governing modifications to production environments: a change request describing what and why, an impact and risk assessment, approval at a level proportionate to the risk (a Change Advisory Board for significant changes, automated pre-approval for standard low-risk ones), scheduled execution, and post-change verification with a rollback path. Its register — the record of every change, approver and outcome — is both the audit trail and the forensic record when something breaks. The modern calibration is risk-tiered: emergency changes follow an expedited path, and routine changes are pre-approved and logged rather than debated.

Why It Matters to You

The executive tension here is speed versus traceability, and the resolution is tiering — not elimination. Organisations that approve everything equally either drown (slow) or bypass (worse: shadow changes, invisible to the register). The questions that matter in review: what fraction of changes are pre-approved standard ones (high is healthy), what is the failed-change rate (a core operational KPI), and — the forensic classic — when something breaks, how quickly can you list everything that changed in the preceding week? An organisation that cannot answer the last question in minutes does not have change control, whatever the policy says.

When You'll Meet It

In IT governance reviews, audit findings, and post-incident investigations. If your regulators or clients audit anything about your technology, they will ask for the change register — make sure it exists before they do.