Every “IT risk” creates some degree of business risk, making it important for chief audit executives (CAE) to thoroughly understand IT change and patch management issues. This GTAG discusses these issues in a language that allows CAEs to build confidence in their knowledge of the area and add value to the conversation when communicating with senior management, the board and IT management.