Page 275 - ITGC_Audit Guides

Figure 2: Sample Steps in a Change Process

1. Identify the need for a
9a. Back out
(if unsuccessful) change

10. Close request 2. Prepare for the change

3. Obtain business
9. Verify/validate change
justification

8. Implement change 4. Obtain approvals

7. Test in appropriate 5. Authorize
environment(s) (via change approval board)

6. Schedule and coordinate
the change

Source: The Institute of Internal Auditors

Scheduling
To assess and report the status of changes continually, management should publish a change
schedule that lists all approved changes as well as planned implementation dates. In alignment
with the organization’s change management process, proposed changes should go before a CAB
comprising business and IT leaders from the organization. Once the changes have been
approved, an implementation schedule should be created, published, and updated regularly. This
process helps provide the information and assurance required to track all changes in their various
states of completion.
Change Management Tools

Although this document will not go into in-depth details, there are numerous software and process
tools available to facilitate and assist in the change management process. Types of tools include
but are not limited to:

 Ticketing systems – often categorized as services management tools. Most have modules for
change, problem, release, knowledge, asset, and configuration management. Organizations
that implement all modules can use the tool to manage their assets from beginning to end.

 Code repositories – allows organizations to manage software updates. Code is stored in a
securely located repository that requires programmers to check out code they are tasked with
changing. Once changes are complete, the code is checked back in. This method ensures
documentation and version control.

12 — theiia.org