A Change Impact Assessment shall be executed to determine potential impact of the change.
Any change presents a set of risks to information assets. The appropriate Asset Owners and the IT custodian shall assess the potential impact of any change prior to approval of the change and assess the risk for not implementing the change.