Change Management: The Control Auditors Love to Test
How to implement a change management process that's rigorous enough for auditors but practical enough for agile teams.
Updated 11 Mar 2026
Why Change Management Matters
Uncontrolled changes are one of the top causes of security incidents. A misconfigured firewall rule, an untested deployment, a hasty infrastructure change — these are how breaches happen.
What ISO 27001 Expects
A.8.32 — Change Management
Changes to information processing facilities and systems shall be subject to change management procedures.
A.8.33 — Test Information
Test information shall be appropriately selected, protected, and managed.
A.8.25 — Secure Development Life Cycle
Security requirements shall be identified and addressed throughout the development lifecycle.
Building a Practical Process
For Infrastructure Changes
1Request — : Document what's changing and why
2Risk Assessment — : What could go wrong? What's the rollback plan?
3Approval — : Who authorises this change? (Not the person making it)
4Testing — : Verify in a non-production environment first
5Implementation — : Follow the approved plan
6Verification — : Confirm the change works as expected
7Documentation — : Update configuration records
For Code Changes
1Feature branch — : All changes in isolated branches
2Code review — : At least one peer review before merge
3Automated testing — : CI pipeline catches regressions
4Staging deployment — : Test in a production-like environment
5Production deployment — : Controlled release with monitoring
Emergency changes happen. Have a fast-track process that:
•Requires verbal approval from a designated authority
•Is documented retrospectively (within 24 hours)
•Goes through post-implementation review
•Is tracked separately for trend analysis
Evidence That Works
•Git history with pull requests and reviews
•Change advisory board (CAB) meeting minutes
•Change request tickets with approval timestamps
•Deployment pipeline logs
•Post-implementation review records
•Emergency change logs
Making It Work With Agile
Change management doesn't mean waterfall. For agile teams:
•Use pull requests as change requests
•Code review = peer approval
•CI/CD pipeline = automated testing gate
•Sprint retrospectives can cover change review
•Keep a lightweight change log for infrastructure
Common Audit Findings
•No separation between development and production environments
•Developers deploying directly to production without review
•No rollback plan for changes
•Emergency changes that never get retrospective documentation
•No evidence of testing before production deployment
The Key Principle
Auditors want to see that changes are controlled, authorised, tested, and documented. How you achieve that can vary — the principle matters more than the specific tool or process.
Related Modules
Standard Controls
Documents
Related Controls / Clauses
A.8.32
A.8.33
A.8.25
A.8.9
A.8.31
26 practitioner guides — included free with your workspace
27 Launchpad generates your full compliance toolkit from a 10-minute setup: policies, risk register, legal register, controls, and AI-assisted document review.