Source Document
MAS TRM Guidelines
MAS.TRM.2021.Sec7.5.3.p24.OBL1
7 IT Service Management > 7.5 Change Management > 7.5.3
Obligation Summary
The FI should ensure all changes are adequately tested in the test environment.
The FI should ensure all changes are adequately tested in the test environment.
MAS TRM Guidelines, Section 7.5.3, p. 24 (2021) · Technology Risk Management Guidelines · p. 24
7.5.2 A risk and impact analysis of the change to an information asset should be conducted before implementing the change. The analysis should cover factors such as security and implications of the change in relation to other information assets.
7.5.3 The FI should ensure all changes are adequately tested in the test environment. Test plans for changes should be developed and approved by the relevant business and IT management. Test results should be accepted and signed off before the changes are deployed to the production environment.
7.5.4 A change advisory board, comprising key stakeholders including business and IT management, should be formed to approve and prioritise the changes after considering the stability and security implications of the changes to the production environment.
What This Requires.
ProfytAI Regulatory Intelligence
Type: requirementThe FI should ensure all changes are adequately tested in the test environment.
Relationship
First of three sentences in paragraph 7.5.3; the others require approved test plans and signed-off results before deployment.
Why This Exists
Testing outside production is the safety barrier that catches defects where they cannot hurt customers or operations.
Implementation Considerations
A maintained test environment and per-change test execution evidence, with test depth proportionate to the change's risk.
Interpretation Note · 'All changes' leaves no category exempt by default; the emergency change route in 7.5.6 is the only differently handled path in the surrounding text. As TRM guidance, SHOULD is a MAS expectation.
This explanation is generated regulatory intelligence, traceable to the citation above.
The byte-exact verbatim text remains the authority you cite.
The captured source page, with this duty highlighted and stamped with its obligation ID, section, and page.
