Skip to main content

Evidence

Every step is on the change's timeline and in the audit log: the versions with their fingerprints, every approval, the times against the window, the outcome and the review. Every change to the settings and approval policies is kept under Settings → Change Management → History, so an auditor can see the controls stayed as they were.

The desk enforces: no start without every approval on the current version; no start outside the window or in a freeze; no approving your own change, and no carrying out a change you alone approved; editing what was approved asks again; standard changes only from a template approved now; pipelines that ask the gate deploy only on a yes.

The desk checks, on the Changes page:

  • Exceptions: risk lowered by hand, proceeding without a customer, running past the window, planned outside a window, reviews overdue, for the last 12 months, with a CSV. An empty list is evidence too.
  • Emergency register: every emergency change, why it couldn't wait, who approved it, and its review (late or not), with a CSV. Auditors test these on their own, because they bypass the normal route.

Legal hold. Legal hold… on a change keeps it, with a reason, whatever housekeeping is set to (Lift legal hold ends it); it needs the desk's Legal holds permission (case.legal_hold). Retention: Settings → Housekeeping has two tasks for closed changes, so changes with approvals are kept on a longer period of their own than those nobody had to approve.

Exports. The Changes list has an Export menu (Excel, CSV, PDF) with its current filters. The PDF button on a change gives its evidence record: the request, the risk answers, every version with its fingerprint, every approval with its approver list, the window against the actual times, the outcome, the review, tasks, links and timeline. Changes are also part of the desk's evidence for auditors: populations, samples and evidence packs.

Reports → Change Management shows changes by type and outcome, the success rate, the emergency share, the approval lead time, changes that caused incidents, and changes by service.