Page 274 - ITGC_Audit Guides

 Changes in performance or capacity requirements.
 New or retired technology.

Scopes of Change

An effective change management process encompasses within its scope any alterations to IT-
based assets on which business services depend. Assets subject to change management
include:
 Hardware – workstations, laptops, tablets, phones, servers, routers, switches, and core
infrastructure components such as power generation or cooling, networked printers, and
mobile devices.
 Software – operating systems, middleware, and applications (including in-house developed
applications and commercial off-the-shelf applications).
 Information, data, and data structures – individual file updates, complete database updates
(e.g., restoration of a previous version), and data integration jobs.
 Security controls – antivirus software, firewalls (both installation of new equipment and of
rules), and intrusion protection/detection systems.
Process Steps

Figure 2 shows likely steps in a change process. However, process steps will differ among
organizations, and some steps may occur concurrently. Appendix C describes a more detailed
change management process.

11 — theiia.org