Change approval bypass in deployment pipeline

CTRL-CHG-031/APRA CPS 230 Operational Risk Management and SOX ITGC expectations for production change approval.

Control statement

All production code changes must be independently reviewed and formally approved by a second engineer before deployment. Deployment tooling must enforce this approval requirement and prevent privileged bypass except under documented emergency change procedure.

What the evidence shows

The branch protection export shows the required approving review count set to zero for the release branch during a six-week window. Deployment records list seven successful releases during that period, and the change advisory register has no linked emergency-change waiver or compensating approval for any of those releases.

Evidence artefacts

github-branch-protection-export-q1-2026.json
prod-deployments-q1-2026.csv
cab-approval-register-q1-2026.xlsx

Affected assets

7 production change records

PressRto run·1–5for stages

Remediation Memory

2 similar past remediations found

94%Similarity
CTRL-CHG-018·closed on 29 Jan 2026
Branch protection enforcement and deployment approval gate restoration
Restored required reviewer count on release branches, removed the automation account exemption, and wired the deployment pipeline to block merges that lack a second-engineer approval.
- Same control domain: Change Management
- Same severity: High
- Control ID family: CTRL-CHG-
- Keyword overlap: branch, protection, deployment, approval, pipeline, release, change
28 min · closed by Olivia4 reusable artefacts
73%Similarity
CTRL-CHG-024·closed on 28 Oct 2025
Emergency change retrospective audit coverage
Closed the gap on emergency change waivers by mandating a 24-hour retrospective review, wiring the change advisory board register to the ITSM platform, and generating audit-ready evidence packages for each emergency release.
- Same control domain: Change Management
- Control ID family: CTRL-CHG-
- Keyword overlap: emergency, change, advisory, waiver, release
71 min · closed by Sophia3 reusable artefacts

Agent workspace

Click "Run remediation agent" to begin. The agent will diagnose the gap, plan the remediation, and ship the work in real time.