Change Approval Procedure

Payment Environment Change Approval Procedure

This procedure specifies actions required of departments that wish to change their existing payment environment, including but not limited to:

  • The re-purposing of existing merchant accounts
  • The alteration of payment systems
  • Any change in business process that affects how card data is processed or handled
  • The addition of or change to any connections to the CCSP Segmented Payment Environment
  • The addition or alteration of relationships with third-party payment service providers.
  1. Any department or unit wishing to make any change to their payment environment as outlined above must contact the Credit Card Support Program (CCSP) and submit the Payment Acceptance Activity Clarification (PAAC) Form to the CCSP Office
  2. The CCSP will contact the requestor if any further clarification regarding the requested change is required.
  3. After a preliminary review with the Information Governance Committee, the requested change will be classified as either "minor" or "significant".
    • 3.1. A MINOR change is one that does not significantly change the process, technology, or risk associated with the merchant's payment acceptance activity.  

       

      • 3.1.1. Minor changes will be reviewed and either accepted or rejected directly by the Information Governance Committee.  The CCSP Office will inform the requesting department of the Information Governance Committee's decision within 1 week of the request date.
    • 3.2. A SIGNIFICANT change is one that would cause the merchant's payment acceptance activity to change in such a way that the risks associated with it need to be formally re-assessed by the Information Governance Committee and approved by University officers.   Specifically, significant changes require approval from the Vice Presidents of Business Operations and Finance.  To facilitate this:
      • 3.2.1. The CCSP will prepare a formal Activity Brief which documents the request. 
      • 3.2.2. The Activity Brief must first receive signofsign offthe requesting department.  This includes signatures from the requester, the department business manager, and responsible university officer.
      • 3.2.3. The signed Activity Brief must be returned to the CCSP office in 426 Grace Hall. 
      • 3.2.4. After Information Governance Committee review, the Activity Brief and any comments and/or recommendations from the Information Governance Committee are reviewed with the requesting department (within three weeks of the request date) and then sent to the Vice President for Business Operations and the Vice President for Finance for final approval.
  4. If the requested change is approved by the Officers, the CCSP group will work with the merchant (or requestor) to implement the change as described in the request.