Tech »  How CIOs can shift from patch and pray to risk-based software change