Rating the Change-Management Finding
In its FY review of change management, internal audit at Citadel Bank sampled 120 of 2,140 changes. Findings: 412 changes were classified 'emergency'; 96 of these touched core banking; 38 had no UAT evidence; 21 were approved by the developer who wrote them; 7 were applied directly in production by the managed-service provider's offshore team using two shared IDs; 60% had no post-implementation review. The IT head argues that emergency changes are unavoidable because regulatory circulars carry short deadlines and the business cannot wait. Separately, the audit committee learns that the last full IS audit was 26 months ago, the IS audit team has three staff (one CISA), and it uses a 2019 checklist not mapped to the regulator's current cyber-security framework. The regulator's inspection begins in six weeks. The audit committee asks you, as head of audit, for a rating, a position on whether this is a 'significant deficiency', and a plan.
1. Rate the severity of the change-management findings. Distinguish design deficiencies from operating failures and justify the rating with specific evidence.
Read the worked answer
Rating: high / significant deficiency - but not everything is equally severe.
- Shared IDs used by the vendor's offshore team to change production (7 changes): design failure (no unique accountability) plus operating failure (no monitoring). Highest severity: it defeats segregation of duties, audit trail and attribution, and breaches outsourcing expectations on access control.
- Developer self-approval (21 of 120 sampled): design failure in the approval matrix. Even one on core banking is material; 21 suggests the control is not operating at all.
- No UAT evidence (38 changes, within 96 core-banking emergencies): operating failure. The risk is an untested change causing a financial or customer-impacting defect.
- Emergency rate of 19% (412/2,140): a symptom, not a cause. It usually means poor release planning and regulatory-change intake, and it normalises bypassing controls.
- No post-implementation review (60%): weak detective control; it prevents learning but is less severe than the above.
The combination of direct vendor production access and no UAT on core banking is what makes this significant rather than a routine observation. The 7 shared-ID changes alone would justify escalation.
2. Draft the audit committee's response: what management must fix in 30/60/90 days, what you will report to the regulator, and what you will not sign.
Read the worked answer
30 days: revoke the two shared IDs; issue named accounts with MFA and privileged access management for all vendor staff; require vendor access through a jump host with session recording; all core-banking emergency changes reviewed by the CAB within 24 hours after the fact.
60 days: publish objective emergency-change criteria with examples and a named approver; block any emergency change lacking a UAT waiver signed by the business owner; enforce the segregation-of-duties matrix in the tool, not in a spreadsheet.
90 days: post-implementation review for all core-banking changes; quarterly sampling by internal audit; emergency-rate KPI reported to the IT steering committee.
To the regulator: report the finding as open, with the rating, root cause, remediation plan, owners and dates. Do not describe it as closed or as an 'isolated exception'.
What I would not sign: an unqualified opinion that change management is effective; a statement that the 21 self-approvals were 'administrative errors' without testing; or a management representation that shared IDs have been removed until I have seen the access logs.
3. Assess the IS audit function's own capability gap and recommend how to close it before the inspection, with only three staff.
Read the worked answer
The audit function has a coverage and competency gap that is itself a finding.
- Coverage: a 26-month gap against an annual policy is a breach of the audit charter and leaves the committee unable to rely on IS audit for that period. Disclose it.
- Methodology: a 2019 checklist not mapped to the current regulatory cyber-security framework means the audit may be measuring the wrong things. Map the plan to the framework and to the bank's risk register before the inspection.
- Competency: three staff, one CISA, is thin for a bank of this size. Co-source the cyber and core-banking reviews with a firm that has demonstrated regulatory experience, and require knowledge transfer, not just a report.
- Independence: confirm the head of IS audit reports functionally to the audit committee, not to the CIO.
- Sampling: 120 of 2,140 is reasonable in size but must be risk-stratified - oversample core-banking and vendor changes.
Before the inspection: produce a one-page remediation plan with dates, a skills and resourcing plan, and an honest statement of the coverage gap. Regulators generally respond better to a credible plan than to a claim that a stale checklist was completed.