1. Purpose
The purpose of this policy is to ensure that all technology and system changes at Bayarcash are managed in a structured and controlled manner. This reduces risks associated with system downtime, data loss, security breaches, or unintended business impact.
2. Scope
This policy applies to:
- All hardware, software, and network changes within Bayarcash.
- System upgrades, patches, configuration changes, new application deployments, and integrations.
- All employees, contractors, and third-party vendors involved in IT systems management.
3. Policy Statement
Bayarcash will:
- Ensure that all system changes are documented, reviewed, tested, and approved prior to implementation.
- Maintain accountability and traceability for all changes.
- Minimize risks to business operations, data integrity, and customer service.
- Ensure compliance with legal, regulatory, and security requirements.
4. Roles & Responsibilities
4.1 Change Advisory Board (CAB)
- Reviews and approves all significant changes.
- Assesses risk, impact, and resource requirements for proposed changes.
4.2 IT / System Administration Team
- Initiates, tests, and implements approved changes.
- Maintains change records and documentation.
- Monitors post-change performance and resolves any issues.
4.3 Employees & Users
- Report system issues or change-related incidents promptly.
- Participate in user acceptance testing when required.
5. Change Classification
Changes are classified based on risk and impact:
- Standard Changes:
- Pre-approved, low-risk, routine changes (e.g., software patch updates).
- Normal Changes:
- Require assessment and CAB approval (e.g., configuration updates, system upgrades).
- Emergency Changes:
- Implemented to resolve critical incidents or security threats.
- Must be documented and reviewed post-implementation.
6. Change Management Process
6.1 Request for Change (RFC)
- Submit RFCs using Bayarcash’s change management system.
- Include description, rationale, risk assessment, back-out plan, and schedule.
6.2 Review & Approval
- CAB evaluates RFCs for risk, impact, and resource requirements.
- High-risk or complex changes require senior management approval.
6.3 Testing
- All changes must undergo testing in a non-production environment.
- User Acceptance Testing (UAT) is required for application or configuration changes affecting business operations.
6.4 Implementation
- Schedule changes during low-impact windows whenever possible.
- Implement changes according to approved plans.
6.5 Post-Implementation Review
- Verify system functionality and stability.
- Document lessons learned and any deviations from the plan.
7. Documentation & Reporting
- Maintain a detailed record of all changes, including RFC, approvals, test results, and post-implementation outcomes.
- Generate regular reports for management review, highlighting trends, failures, and improvements.
8. Risk Management
- Conduct a risk assessment for every change.
- Identify dependencies, potential business impacts, and mitigation strategies.
- Maintain back-out or rollback plans for all non-standard changes.
9. Compliance
-
All changes must comply with:
- Regulatory requirements relevant to financial operations.
- Bayarcash internal security and data protection policies.
-
Unauthorized or unapproved changes may result in disciplinary action.
10. Training & Awareness
- IT staff must receive regular training on change management processes and tools.
- Users impacted by changes should be informed in advance and trained on new procedures or systems.
11. Policy Review
- This policy will be reviewed annually or following significant incidents, system upgrades, or organizational changes.
- Updates must be approved by the CAB and executive management.