During a review of the change management process, an IS auditor finds that emergency changes are deployed directly to production by on-call engineers using elevated access, and that the process relies on a documented step to formally record and approve the change after deployment. Which control MOST effectively ensures that these emergency changes do not become a means to bypass normal change governance?