SOX.6.1.4:: Difference between revisions
No edit summary |
No edit summary |
||
| (6 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | |||
[[Image:Key-control.jpg]]<br> | [[Image:Key-control.jpg]]<br> | ||
::'''2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.''' | ::'''2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.''' | ||
:::a. [[SOX.6.1.4:|'''SOX.6.1.4''']] Emergency change requests are documented and subject to formal change management procedures. | |||
<br> | |||
<br> | |||
</blockquote> | |||
<br> | |||
'''Testing Procedures''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
1. Determine if a process exists to control and supervise emergency changes. | |||
<br> | |||
<br> | |||
2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed. | |||
<br> | |||
<br> | |||
3. Determine that procedures require emergency changes to be supported by appropriate documentation. | |||
<br> | |||
<br> | |||
4. Establish that backout procedures are developed for emergency changes. | |||
<br> | <br> | ||
<br> | <br> | ||
5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made. | |||
<br> | |||
<br> | |||
6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented. | |||
</blockquote> | |||
<br> | |||
'''Testing Frequency''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
Annually | |||
<br> | |||
</blockquote> | |||
'''Evidence Archive Location''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
Insert hyperlink or location of evidence archive. | |||
<br> | |||
</blockquote> | |||
'''Control Stewards Process Narrative''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
<p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p> | |||
<br> | |||
'''Control Steward – Jane Manager''' | |||
<br> | |||
</blockquote> | |||
'''Process Illustration''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration. | |||
<br> | |||
</blockquote> | |||
'''Control Status and Auditors Commentary''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
<p><font color=#008000>The control is effective.</font></p> | |||
<br> | |||
[[Image:greenlock.jpg]]<br> | |||
<br> | |||
Status is acceptable. | |||
<br> | |||
</blockquote> | |||
'''Control Exception Commentary''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
Status is acceptable. | |||
<br> | |||
</blockquote> | |||
'''Remediation Plan''' | |||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | |||
Remediation is not required at this time. | |||
<br> | <br> | ||
</blockquote> | |||
Latest revision as of 13:56, 23 June 2006
- 2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.
- a. SOX.6.1.4 Emergency change requests are documented and subject to formal change management procedures.
Testing Procedures
1. Determine if a process exists to control and supervise emergency changes.
2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed.
3. Determine that procedures require emergency changes to be supported by appropriate documentation.
4. Establish that backout procedures are developed for emergency changes.
5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made.
6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented.
Testing Frequency
Annually
Evidence Archive Location
Insert hyperlink or location of evidence archive.
Control Stewards Process Narrative
Provide control steward commentary indicating the formal methodology in place.
Control Steward – Jane Manager
Process Illustration
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
Control Status and Auditors Commentary
The control is effective.
File:Greenlock.jpg
Status is acceptable.
Control Exception Commentary
Status is acceptable.
Remediation Plan
Remediation is not required at this time.