Go-live must be authorised against recorded criteria by a named owner

Control Statement: A release to production must be authorised by a named owner against criteria recorded before the authorisation.

Description: This applies to the first go-live and to any later release of substance. The criteria are the organisation’s own — this control does not say what they must contain, only that they exist, that they were written before the decision they governed, and that a named person authorised the release against them. A criterion consciously waived, with the waiver recorded, satisfies the control; a criterion quietly reworded after the fact does not.

Rationale: Without recorded criteria, “ready” means whatever was said loudest in the last meeting before the deadline — and after an incident, nobody can establish what was actually promised to work. The record is what makes the decision ownable: it separates a release somebody authorised, on stated grounds, from a release that simply happened when the time ran out. A go-live nobody authorised is a go-live nobody owns when it goes wrong.

Audit Procedure:

1. Confirm go-live criteria exist and were recorded before the authorisation they governed.
2. Confirm each release to production carries an authorisation by a named owner.
3. Confirm criteria that were not met were recorded as waived, with the reason, rather than removed or reworded.
4. Sample a recent release and confirm the record shows who decided, and against what.

Remediation:

1. Write the criteria for the next release; keep them few and checkable.
2. Name the owner who authorises against them.
3. Record the authorisation, and any waivers with their reasons.
4. Keep the records in the system of record, so later releases inherit the practice.

Default Value: Creatio does not distinguish go-live from any other day. Nothing in the platform requires criteria, an authorisation, or a record of either.