Who should approve changes to control-library fields?

Approval should come from the business owner of the control taxonomy, not merely the person who has system administrator access. Depending on the field, that may be the CAE, methodology owner, SOX program owner, compliance lead, risk owner, or another designated control-library owner.

The administrator may implement the change, but approval should confirm the field's purpose, definition, required status, allowed values, downstream use, and effective date. For material changes, a second-person review helps protect reporting integrity and segregation of duties.