For those systems that are not in the cloud and in a world of growing cyber security threats, maintaining patches and updates has never been more important.  In an organization of any size, proper change management and regular system reviews should be a regular occurrence in order to protect your organization from cyber threats or to plan for upgrades and/or migrations before systems become end of life’d or have severe security threats.  We recommend a systematized approach that is tailored to your business environment – some aspects may best be done by a 3rd party security company or by a subject matter expert in the system, but a lot of it can be done internally within your company if the resources are available.  To ensure congruity, a process workflow should be created along with checks and balances to ensure that, even if a key stakeholder leaves, the process can be picked up by someone else in the organization.