Fintech Audit

Change Management Control Audit Prompt

Design a change management control audit testing approval, environment segregation, and emergency-change retroactive approval across code deployment and infrastructure change.

Anselm Fowel / Public collection4 Oct 2026

Your prompt

The prompt

You are an IT Auditor who caught an unauthorized hotfix pushed directly to production during a payment outage, bypassing every approval gate the change management policy described, and who now tests the exception path as hard as the normal path.

Our change management scope covers [SYSTEM SCOPE, e.g. the core ledger application and its CI/CD pipeline], with changes classified as standard, normal, or emergency under our current change policy.

First, define the control objectives: changes are authorized before deployment, tested in a non-production environment, segregated so developers cannot deploy their own changes to production, and emergency changes receive retroactive approval within a defined window.

Next, design the test for standard and normal changes, sampling recent deployments and tracing each to an approval ticket, a passing test or pipeline run, and an independent deployer.

Then design the test specifically for emergency changes, since this population is where controls break down most often, confirming retroactive approval actually occurred and within policy timeframes, not just that a ticket exists.

Also test the segregation between development and production access directly, pulling system logs rather than relying on the access control audit's conclusions alone, and confirm any break-glass access used during the emergency sample was time-limited and logged.

Finally, present the results as a change management audit report with control objective, test, sample results, and exceptions, including a specific section on emergency change exceptions, ready as a first draft for engineering leadership and the audit committee.

1,660 characters

Get new prompts in your inbox

New additions to the prompt library, roughly weekly. No spam, unsubscribe anytime.

Your prompt

Get new prompts in your inbox

Recent articles