Change management auditing is the process by which companies can effectively manage change within their
information technology systems. Changes to computer
software must be monitored in order to reduce the risk of data loss, corruption, malware, errors, and security breaches.
Change risks
Proper change control auditing can lower the following risks:
The following features are commonly part of a change management auditing procedure:
Change management procedures are formally documented and controlled.
Changes are requested in a formal process.
Requests are recorded and stored for reference.
The effect of the requested change is assessed.
Each change is assessed based on its projected effect to the computer system and business operations. The assessment is documented with the request.
Priority is based on urgency, potential benefits, and the ease with which changes can be corrected.
Controls are imposed on changes.
Changes are limited by automated or manual controls. In particular, unauthorized changes are periodically searched for.
An emergency change process is in place.
Policies clearly define emergency changes. Generally, these are errors that significantly impair system function and business operations, increase the system's vulnerability, or both. Emergency changes override some, but not all, controls. For instance, a proposed change might be documented, but not permitted without authorization.
For security, new software releases often require controls such as back ups, version control, and a secure implementation.
Software distribution is assessed for compliance.
Software distribution is assessed for compliance with license agreements. Noncompliance can have disastrous
financial and legal results.
Changes are submitted for approval.
Proposed changes are submitted for approval after auditors have reviewed the required resources, other changes, the effect, urgency, and the system's stability.