During the testing phase, a new requirement surfaced and the stakeholder asked the developer to modify the code without informing the Business analyst (BA). The BA became aware of the new…

A risk strategy addresses potential threats to the project but does not govern how changes to requirements or design are submitted, approved, and communicated.

A prioritization approach ranks requirements by business value or urgency but provides no mechanism to control or track how changes enter the project.

A change control process establishes defined procedures for submitting, reviewing, approving, and communicating changes to requirements or solution design, ensuring the BA is always informed before modifications are made. Without it, developers can implement undocumented changes that create defects and break traceability between requirements and the solution. Formalizing this process prevents ad hoc modifications and keeps all parties aligned on the current baseline.

A stakeholder engagement plan defines communication approaches and responsibilities but does not enforce a formal change submission and approval workflow.