Hello!
We set up policies around items important to us to track plus what our auditors require, otherwise most everything is available via audit tables or audit reports inside OS. For ex:
- Master data updates are mostly completed through ACM with some exceptions that are tracked with manual approvals against an audit report out of OS.
- BR changes, "key" CV changes, Marketplace tool updates, security updates, among other things I'm sure I'm forgetting require approval which are stored in a folder for auditor review.
- OS platform upgrades require documenting change ticket in our service now system.
- Regular day-to-day activities do not require approval. We've defined these as transformation rule updates, data management updates, dashboard updates, etc.
There's likely a level of change you'll have to determine as a company to determine what gets tracked and what doesn't to strike a good balance between risk and tracking time spent/wasted.