SCC4 Settings

I'm doing a security review of an SAP production system.

Changes and transport for client specific changes has been set to "No changes" which is fine.

eCatt and CATT have been set to allowed - Does the first setting overwrite these being allowed or is this a risk?

Any help appreciated. Thanks