Are changes to applications (updates, configurations) controlled and reviewed?

You find that your single IT person makes updates to live applications whenever needed, often without telling anyone else or keeping notes. There is no record of what was changed, why, or when—if something breaks, nobody knows who to ask.

You have a basic email or WhatsApp group where the IT person announces they are making a change, but there is no formal approval before they proceed. After the change, someone may write it down in a notebook or spreadsheet, but this is inconsistent and often forgotten.

You have a simple spreadsheet or document where all application changes are logged with date, description, and person's name before they are made. Someone (usually the manager) approves the change in writing via email before it happens.

You have a formal change log document or simple shared system (like a Google Sheet or basic ticketing tool) where every change request must be submitted, reviewed by at least one other person, approved by management, and then documented after completion. All changes are tied to a business reason or ticket.

You use a dedicated change management tool or system (even a free one like Jira or custom-built tracker) that forces a workflow: request → approval → implementation → verification. Changes are categorized by risk level, and high-risk changes require testing on a separate non-live environment first.

You have an automated change management system integrated with your development pipeline, with role-based approval workflows, automatic rollback capabilities, and continuous audit trails. Changes are automatically tested, documented, and tracked with full traceability for compliance audits.