Ideally your site has some type of "early adopters" who would have an opportunity to test-drive any software maintenance, including SAS and especially consideirng the varied components and capabilities the SAS product suite provides to an enterprise. Of course, the amount of time invested with suitable testing and follow-on re-testing is an unknown and must be weighed on merits related to any particular software vendor and their track-record.
I'd suggest that you will want to propose, develop, maintain and execute some type of SAS software maintenance/fix/upgrade initiative and methodology document -- one that is well-aware by your mgmt, with written concurrence.
Scott Barry
SBBWorks, Inc.