information approved change request risk