SOX.6.1.1:

1. Risk: Availability of critical systems is decreased because system changes (regular or emergency) have not been evaluated and tested prior to moving the changes to production.

a. SOX.6.1.1: Requests for program changes, system changes and maintenance (including changes to system software) is standardized, logged, approved, documented and subject to formal change management procedures.

Testing Procedures

1. Determine that a documented change management process exists and is maintained to reflect the current process. Consider if change management procedures exist for all changes to the production environment, including program changes, system maintenance and infrastructure changes. Evaluate the process used to control and monitor change requests. Consider whether change requests are properly initiated, approved and tracked. Determine whether program change is performed in a segregated, controlled environment.

2. Select a sample of changes made to applications/systems to determine whether they were adequately tested and approved before being placed into a production environment. Establish if the following are included in the approval process:

1.) operations,

2.) security,

3.) IT infrastructure management and IT management.

3. Evaluate procedures designed to determine that only authorized/approved changes are moved into production.

4. Trace the sample of changes back to the change request log and supporting documentation.

5. Confirm that these proceduresaddress the timely implementation of patches to system software.

6. Select a sample to determine compliance with the documented procedures.

Testing Frequency

Annually

Evidence Archive Location

Insert hyperlink or location of evidence archive.

Control Stewards Process Narrative

Provide control steward commentary indicating the formal methodology in place.

Control Steward – Jane Manager

Process Illustration

Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.

Control Status and Auditors Commentary

The control is effective.

File:Greenlock.jpg

Status is acceptable.

Control Exception Commentary

Status is acceptable.

Remediation Plan

Remediation is not required at this time.