SOX.6.1.4:: Difference between revisions
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
<blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | <blockquote style="background: #C8CDC7; padding: 1em; margin-left: 0.5em;"> | ||
[[Image:Key-control.jpg]]<br> | [[Image:Key-control.jpg]]<br> | ||
::'''2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.''' | ::'''2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.''' | ||
:::a. [[SOX.6.1.4:|'''SOX.6.1.4''']] Emergency change requests are documented and subject to formal change management procedures. | :::a. [[SOX.6.1.4:|'''SOX.6.1.4''']] Emergency change requests are documented and subject to formal change management procedures. | ||
<br> | <br> | ||
| Line 11: | Line 9: | ||
'''Testing Procedures''' | '''Testing Procedures''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
1. Determine | 1. Determine if a process exists to control and supervise emergency changes. | ||
<br> | |||
2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed. | |||
<br> | |||
3. Determine that procedures require emergency changes to be supported by appropriate documentation. | |||
<br> | |||
4. Establish that backout procedures are developed for emergency changes. | |||
<br> | |||
5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made. | |||
<br> | |||
6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented. | |||
<br> | <br> | ||
<br> | <br> | ||
| Line 21: | Line 27: | ||
::3.) IT infrastructure management and IT management. | ::3.) IT infrastructure management and IT management. | ||
<br> | <br> | ||
3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production. | 3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production. | ||
<br> | <br> | ||
| Line 34: | Line 39: | ||
<br> | <br> | ||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
'''Testing Frequency''' | '''Testing Frequency''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
| Line 43: | Line 45: | ||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
'''Evidence Archive Location''' | '''Evidence Archive Location''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
| Line 49: | Line 50: | ||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
'''Control Stewards Process Narrative''' | '''Control Stewards Process Narrative''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
<p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p> | <p><font color=#008000>Provide control steward commentary indicating the formal methodology in place.</font></p> | ||
<br> | <br> | ||
'''Control Steward – Jane Manager''' | '''Control Steward – Jane Manager''' | ||
<br> | <br> | ||
</blockquote> | </blockquote> | ||
'''Process Illustration''' | '''Process Illustration''' | ||
<blockquote style="background: white; border: 1px solid black; padding: 1em;"> | <blockquote style="background: white; border: 1px solid black; padding: 1em;"> | ||
Revision as of 13:53, 23 June 2006
- 2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.
- a. SOX.6.1.4 Emergency change requests are documented and subject to formal change management procedures.
Testing Procedures
1. Determine if a process exists to control and supervise emergency changes.
2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed.
3. Determine that procedures require emergency changes to be supported by appropriate documentation.
4. Establish that backout procedures are developed for emergency changes.
5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made.
6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented.
2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process:
- 1.) operations,
- 2.) security,
- 3.) IT infrastructure management and IT management.
3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production.
4. Trace the sample of changes back to the change request log and supporting documentation.
5. Confirm that these proceduresaddress the timely implementation of patches to system software.
6. Select a sample to determine compliance with the documented procedures.
Testing Frequency
Annually
Evidence Archive Location
Insert hyperlink or location of evidence archive.
Control Stewards Process Narrative
Provide control steward commentary indicating the formal methodology in place.
Control Steward – Jane Manager
Process Illustration
Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.
Control Status and Auditors Commentary
The control is effective.
File:Greenlock.jpg
Status is acceptable.
Control Exception Commentary
Status is acceptable.
Remediation Plan
Remediation is not required at this time.