Change management auditing
1988173
197941402
2008-03-13T11:49:14Z
Kuru
764407
rmv promotional external link
{{Confusing|date=December 2006}}
{{buzzword}}
{{expert-subject|computer science}}
{{Refimprove|date=July 2007}}
<!-- Unsourced image removed: [[Image:changemanagement.jpg|thumb|300px|right|A diagram of change management.]] -->
'''[[Change management]] [[audit]]ing''' is an information technology (IT) procedure for limiting unauthorized changes and errors to computer systems and disruptions to a company's IT assets, computer applications, and operating systems. A change management control system has specific procedures that define analysis, application, and review of changes to the computer infrastructure. Change management is therefore important to a company's IT security.
== Change risks ==
Proper change control auditing can mitigate the following risks:
* [[Security]] features of the network turn off.
* Harmful code is distributed to users.
* Sensitive [[data]] is lost or becomes insecure.
* [[Financial report]] errors occur.
== Control procedure ==
The following features are commonly part of a change management auditing procedure:
;[[Change management]] procedures are formally documented and controlled.
;Changes are requested in a formal process.
: Requests are recorded and stored for reference.
;The effect of the requested change is assessed.:Each change is assessed based on its projected effect to the computer system and business operations. The assessment is documented with the request.
: Priority is based on urgency, potential benefits, and the ease with which changes can be corrected.
;Controls are imposed on changes.:Changes are limited by automated or manual controls. In particular, unauthorized changes are periodically searched for.
;An emergency change process is in place.:Policies clearly define emergency changes. Generally, these are errors that significantly impair system function and business operations, increase the system's vulnerability, or both. Emergency changes override some, but not all, controls. For instance, a proposed change might be documented, but not permitted without authorization.
;Change documentation is periodically updated.
;Maintenance tasks and changes are recorded.
;Controls are applied to new [[software]] releases.:For security, new software releases often require controls such as back ups, version control, and a secure implementation.
;[[Software distribution]] is assessed for compliance.:Software distribution is assessed for compliance with licence agreements. Noncompliance can have disastrous [[financial]] and legal results.
;Changes are submited for approval.:Proposed changes are submitted for approval after auditors have reviewed the required resources, other changes, the effect, urgency, and the system's stability.
;[[Separation of duties|Duties are separated]]:Responsibility for creation, approval, and application are assigned to different personnel to avoid undesired changes.
;Changes are reviewed.:Changes are monitored to assess the efficacy of [[change management]] policies.
== See also ==
* [[Change management]]
* [[Information technology audit]]
* [[Information technology audit - operations]]
== External links ==
* [http://www.iso.org International Organization for Standardization (ISO)]
* [http://www.isaca.org Information Systems Audit and Control Association (ISACA)]