Page 268 - ITGC_Audit Guides

Business Significance: Risks and

Opportunities

What is change management and why is it significant? In the current business environment,
a well-thought-out and systematic change management process is no longer optional; rather, it is
necessary for an organization to effectively achieve its business objectives.

Change management can be defined as the systematic set of processes that are executed within
an organization’s IT function to manage enhancements, updates, installations, implementations,
incremental fixes, and patches to production systems. The processes may include (but are not
limited to):

 Application code revisions.
 System upgrades (e.g., applications, operating systems, and databases).
 Infrastructure changes (e.g., servers, cabling, routers, and firewalls), including on-premise,
cloud, and mobile.
 Security patches/updates (e.g., correcting known security vulnerabilities in hardware,
software, applications, and databases).
Change management can also be described as a consistent and understood process to minimize
disruption while modifying the IT environment.

 Addition or deletion of hardware and software.
 Code modifications or revisions.
 Configuration changes to existing hardware.

 Regular system updates or patches.
 Data modifications (e.g., restoring from backup).
The exact structure of the change management process may differ in every organization, but the
goal of change management in an IT environment is to ensure that change requests (including
emergency maintenance) are handled quickly, efficiently, and effectively. This goal is
accomplished by following consistent procedures and maintaining them in a controlled manner.
This systematic approach improves business operations by reducing the potential of issues
related to confidentiality, integrity, or availability.
Properly implemented, change management protects the production environment (“live”
environment) and provides the organization with a repeatable, measurable, and auditable
process that captures all technology-related changes.

5 — theiia.org