An Auditor Asked Who Approved a Change Our Pipeline Made

Description and use

The CI/CD pipeline now records change metadata (commit, reviewers, checks, target) at execution time, satisfying audit requirements while preserving automation benefits.

Problem

Internal audit required approval records for production changes, but automated pipeline changes had no human approval record.

Outcome

Audit compliance achieved by moving evidence generation into the pipeline, eliminating the need for manual approval tickets and preserving automation efficiency.

Workflow

• 1. Identify automated change classes (e.g., firewall rule updates, scaling policy adjustments, certificate renewals).
• 2. Configure pipeline to capture execution metadata: commit hash, merge request reviewers, automated policy check results, and affected resources.
• 3. Emit a change record (e.g., JSON or database entry) at the moment the pipeline applies the change.
• 4. Store records in an audit‑ready repository or logging system.
• 5. For manual elevated‑rights jobs, generate a separate, more detailed record and schedule weekly review.
• 6. Provide auditors with access to the change record repository instead of traditional approval forms.

Evidence

The pipeline now writes the change record itself, at the moment it acts, carrying the commit, the reviewers, the checks that passed, what it changed and where.

Source

Automation does not remove the need for a control. It moves the control earlier, into the review and the definition, and it leaves the organisation with a governance process still watching the place where the work used to happen.

Source