Page 294 - ITGC_Audit Guides

 Does not take existing change management into consideration while implementing emerging technology with
automated approval and promotion features.

 Fails to consider change management processes in the vendor selection and management processes.

Performing this indirect assessment can provide internal audit with insights to aid in the larger
evaluation of the change management process as a whole.

In addition, Table E.3 compares traits of an organization with an effective versus an ineffective IT
change management program in place. This list is not exhaustive but is intended to help
organizations understand the positive outcomes of effective processes.

Table E.3: Change Management Processes – Effective and Ineffective Characteristics

Market Level
Effective
 Company is positioned to act on new business opportunities that require additional or upgraded IT capability.
 Opportunities are sufficiently planned and managed in a predictable manner.
 IT-supported products and services are released to the market as planned and expected.

Ineffective
 Lost opportunities. The organization is unable to consistently deploy planned new products and services.
This may occur because unmanaged/mismanaged changes required the diversion of resources to
unplanned work.
 Development projects are late and over budget, resulting in late or costly products and services when
compared to competitors.

Client Level
Effective
 Adequate resources to support the client.

 Products and services perform as advertised and demonstrate a consistent, reliable level of product and
service quality.
 Customer issues and complaints are resolved in a timely manner.

 Decreasing demand for customer support center/help desk resources.
 Appropriate stakeholders are involved in assessing risks associated with proposed IT changes and
prioritizing their implementation.
 Participants in the IT change process understand the relevant categories and priorities of changes and the
levels of formality and rigor required to implement each change.
 Because of the foundational nature of IT change management, ensuring compliance with new regulations
requires less effort.

Ineffective
 Inadequate resources.
 Products and services do not perform as advertised or as intended or operate with flaws, leading to
unreliable product and/or low service quality. If customers can switch easily to another provider, they will.

31 — theiia.org