View source for AI7.12:

'''AI 7.12 Post-implementation Review'''<br>
<br>
'''Control Objective:'''<br>
<br>
Establish procedures in line with the enterprise development and change standards that require a post-implementation review of the operational information system to assess and report on whether the change met customer requirements and delivered the benefits envisioned in the most cost-effective manner.<br> 
<br>
'''Applicability:'''<br>
<br>
:: '''Sarbanes-Oxley'''
:: HIPAA
:: GLBA
:: PCI
:: FISMA
:: NIST SP 800-66
:: Ditscap
:: Control Exception
:: User Defined
<br>
'''Risk Association Control Activities:'''<br>
<br>
[[Image:Key-control.jpg]]<br>
::'''1.	Risk: Business requirements are not met or inadequately tested. Systems produce inaccurate results or do not meet usability requirements. A project that does not meet business requirements for internal controls at a milestone may continue without review and approval.'''<br>
:::a.	[[SOX.1.2:|'''SOX.1.2''']] IT management involves users in the design of applications, selection of packaged software and the testing thereof, to maintain a reliable environment.<br>
<br>
::'''2.	Risk: A project that has been implemented fails to meet the business needs.'''<br>
:::a.	[[SOX.1.18:|'''SOX.1.18''']] Post implementation reviews are performed to verify controls are operating effectively.<br>
<br>
'''Implementation Guide:'''<br>
<br>
'''Process Narrative'''<br>
Insert a description of the process narration that is applicable to the existing control statement this narrative refers to.<br>
<br>
'''Process Illustration'''<br>
Insert a process diagram, flowchart or other visual representation here to illustrate the process narrative.<br>
<br>
[[Image:Someimage.jpg]]<br>
<br> 
'''Control Commentary'''<br>
Insert a description of the control that is applicable to the existing control statement this commentary refers to.<br>
<br>
'''Control Exception Commentary'''<br>
Insert a description of the control exception that is applicable to the existing control statement this commentary refers to.<br>
<br>
'''Evidence Archive Location'''<br>
Insert Evidence Description Here.<br> 
<br>
'''Control Status and Auditors Commentary'''<br>
Describe the condition of the applicable control and its effectiveness. Set the color icon to a redlock.jpg, yellowlock.jpg or greenlock.jpg.<br>
<br>
[[Image:redlock.jpg]]<br>
<br>
'''Remediation Plan'''<br>
Insert remediation plan, applicability, or any information that indicates what needs to be done.<br>
<br>
'''Supplemental Information:'''<br>

<br>
'''Implementation guidance'''<br>
Insert guidance in this section if it helps to elaborate upon the subject matter. Examples of evidence that would help guide the end user is desirable.<br>


--[[User:Mdpeters|Mdpeters]] 07:59, 23 June 2006 (EDT)