1) Request Form dated 28 Mar 14 from Sr. Programmer has requested to separate Server Internal Test from Server Develop. This has been approved on 31 Mar 14. There is no RA related to this change and the control measure of security control of this change.
2) The Change Management Policty TeleIntel-Policy-17 Rev.01 mentioned only about assessing change by review completeness of change request, it did not cover the risk asssessment of change (Impact after change, Risk during change). It also did not cover method to test the success of change, nor the roll back if the change is not successful.
3) The record for Change of Antivirus Software to NOD32 was not found.
However, the organization could still providing the services to client with good availability performance. The Change Requests were found for most of the case. So this is graded as a Minor NCR.