View source for SOX.6.1.1:

<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;">
[[Image:Key-control.jpg]]<br>
::'''1.	Risk: Availability of critical systems is decreased because system changes have not been evaluated and tested prior to moving the changes to production.'''<br>
:::a. SOX.6.1.1: Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures. 
<br>
<br>
</blockquote>
<br>
'''Testing Procedures'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider 
if change management procedures exist for all changes to the production environment, including program changes, system 
maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether 
change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated,
controlled environment. 
<br>
<br>
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process: 
operations, security, IT infrastructure management and IT management. 
<br>

Evaluate procedures designed to determine that only authorized/approved changes are moved into production.
<br>

Trace the sample of changes back to the change request log and supporting documentation. Confirm that these proceduresaddress the timely implementation of patches to system software. 
<br>

Select a sample to determine compliance with the documented procedures. 

</blockquote>

'''Testing Frequency'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Annually
<br>
</blockquote>

'''Evidence Archive Location'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Insert hyperlink or location of evidence archive.
<br>
</blockquote>

'''Control Stewards Process Narrative'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p>

<br>
'''Control Steward – Jane Manager'''
<br>
</blockquote>

'''Process Illustration'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
<br>
</blockquote>

'''Control Status and Auditors Commentary'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
<p><font color=#008000>The control is effective.</font></p>
<br>
[[Image:greenlock.jpg]]<br>
<br>
Status is acceptable.
<br>
</blockquote>

'''Control Exception Commentary'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Status is acceptable.
<br>
</blockquote>

'''Remediation Plan'''
<blockquote style="background: white; border: 1px solid black; padding: 1em;">
Remediation is not required at this time.
<br>
</blockquote>