A regulatory audit of an IT department has identified discrepancies between processes described in the procedures and what is actually done by system administrators. The discrepancies were caused by r

Assigning responsibility for periodic revisions is a reactive approach and does not guarantee that documentation will be updated promptly when changes occur, leading to potential discrepancies in between revision cycles.

Requiring employees to confirm compliance annually is a control measure, but it does not address the root cause of the discrepancy, which is the failure to update documentation when underlying processes change.

Including the update of documentation within the change management framework ensures that whenever an IT application change occurs, the corresponding procedures and documentation are automatically reviewed and updated as part of the formal change process. This proactive approach prevents the divergence between "what is written" and "what is done" and ensures compliance with regulatory requirements by keeping documentation current.

Establishing high-level procedures to minimize process changes might seem appealing but can stifle necessary evolution and improvements, and it doesn't solve the problem of ensuring documentation matches actual processes when changes inevitably happen.