SOX.6.1.4:

2. Risk: System integrity and availability is compromised because emergency changes are made without management approval.

a. SOX.6.1.4 Emergency change requests are documented and subject to formal change management procedures.

Testing Procedures

1. Determine if a process exists to control and supervise emergency changes.

2. Determine if an audit trail exists of all emergency activity and verify that it is independently reviewed.

3. Determine that procedures require emergency changes to be supported by appropriate documentation.

4. Establish that backout procedures are developed for emergency changes.

5. Evaluate procedures ensuring that all emergency changes are tested and subject to standard approval procedures after they have been made.

6. Review a sample of changes that are recorded as “emergency” changes, and determine if they contain the needed approval and the needed access was terminated after a set period of time. Establish that the sample of changes was well documented.

Testing Frequency

Annually

Evidence Archive Location

Insert hyperlink or location of evidence archive.

Control Stewards Process Narrative

Provide control steward commentary indicating the formal methodology in place.

Control Steward – Jane Manager

Process Illustration

Replace this test by inserting a process diagram, flowchart or other visual representation to illustrate the process narrative as necessary. Include a brief description of the process illustration.

Control Status and Auditors Commentary

The control is effective.

File:Greenlock.jpg

Status is acceptable.

Control Exception Commentary

Status is acceptable.

Remediation Plan

Remediation is not required at this time.