Once the impact is assessed, a decision is made on what to do.

This could include deferring a decision, not doing anything, or implementing the change.

Data Migration

In cases where existing data is impacted, it is often necessary to conduct a data migration activity.

This is equally or more important than controlling the change itself!

This is likely touching data used for regulatory purposes.

Planned and Validated

The migration needs to be planned and the migration itself validated.

We’ll talk more about validating data migration later but recognize the importance of this activity.

Full Lifecycle

When implementing the change, the full lifecycle as described earlier should be followed:

• Requirements
• Design
• Test
• Validation

Typically, a separate installation can be established to implement and test the change, isolated from the production environment.

If not, control gets much trickier and may require some down time where users are locked out of the system while the change is rolled out and validated.