Document change management process for the Card system

As a live service the Card System is subject to change control. Document how changes are agreed and applied. Do all changes go through CAB? If not what alternative approach is used?