Our workflow that is sox compliant: A single team can write and deploy their own services. We deploy multiple times per day as a team and hundreds of times per

Our workflow that is sox compliant: A single team can write and deploy their own services. We deploy multiple times per day as a team and hundreds of times per day as an organization. The dev who wrote it is not the dev who approves it. We have automated test suites. Tests pass and someone on the team acts as quality assurance by verifying code and tests that were added. Anyone on the team can deploy at any time. For auditing, all code and configuration changes are tracked in jira. If it changes the system, it gets a ticket. That ticket links to the pull request (and vise versa). The pull request cannot be merged until another person clicks approved. The PR branch is ran through the test suites and after merging, the main branch gets the same treatment. The artifacts for deployment are gated by passing master/main builds. If everything is green, then the CI/CD system allows us either to automatically roll out changes or gate them with another manual step of clicking a button. At the step right before something would be released, the approver (who didn’t write the code but is on the same team) comments on the ticket that it is verified and approved. That’s pretty much it. From the trenches of a public company. And I got to be part of going through a dozen person start up to a several hundred person public company and go from everyone has root access with the same account and password to the world of access controls. A wild ride for sure :)