What does change control mean in IT-related SOPs?

• A. A casual notification process
• B. A formal process to evaluate and approve changes to IT systems and software that affect procedures
• C. A policy only for hardware upgrades
• D. A process to anonymize data in SOPs

Answer: (B)

Change control is a formal, documented process for evaluating and approving changes to IT systems and software that affect how procedures operate. It ensures that every modification is reviewed for potential impacts on security, reliability, performance, and compliance before it’s implemented. By requiring an assessment, testing, and authorization, it creates a clear plan for deployment and a rollback option if something goes wrong, keeping operations predictable and auditable.

In IT-related SOPs, this ties changes to the procedures themselves, so updates to workflows reflect the actual system changes. Typical elements include assigning responsibility (who owns the change), a formal review or approval (often via a change advisory board), documenting the rationale and risks, testing in a controlled environment, and recording the implementation and post-implementation review.

Why the other ideas don’t fit: a casual notification process lacks the formal evaluation and authorization that prevent unexpected disruptions; limiting the process to hardware upgrades misses software, configurations, and procedural impacts; and anonymizing data in SOPs has nothing to do with managing changes to IT systems or procedures.