To your question specifically, the fact that they're living together, or friends, has nothing to do with their job performance
It's possible they may be violating company policy by not managing their changes through a proper change control process...
However! As someone who has worked at many regulated orgs.... It is sometimes amazing what they decide isn't necessary for change control.
It's entirely possible their manager is aware, and even allowed the work they're doing outside of the change process, if he believed it was minor and wouldn't be of any impact....
I've seen org's with very different definition of what constitutes a 'change', as far as they are worried about.
Now, what I would recommend you do:
- Completely ignore the fact that they live together or are friends. This is useless information to you or anyone else.
- If a change is made to a production environment that causes an issue, very delicately ask if it went through a change control review meeting, where people could have been aware that a change to this system was being made.
-- That's really the end of it. The business will sort itself out from there... and if not, it's really not your responsibility / job to spend any time on it.
If it causes any kinds of issues or delays or irritation for you - very politely let your manager know / keep them aware that something has happened that has impacted you, with this system. Really, the fact that a change control wasn't made isn't that relevant to the communication with your manager.... The responsibility on that one will be overviewed more by those employees direct manager and then the person above them
You mention that one person will make a change and the other will approve it - If this is the company policy, that only one other person has to have a set of eyes on it, then theoretically there is nothing 'wrong' with this. If issues arise from this, I would maybe raise to your manager that you'd like more stringent requirements on who can approve change requests.... But if the policy is written that loosely as is, and they're technically following it, the fact that they're buddies doesn't change that they are correctly fulfilling the policy... and businesses don't change these processes often at all... Mostly because if any tweak to the process is suggested, all of the directors and VP's will sit in a room rethinking the entire process and get nowhere after dozens of meetings