Mechanisms exist to prohibit unauthorized changes, unless organization-approved change requests are received.
Does the organization prohibit unauthorized changes, unless organization-approved change requests are received?