Chapter 10

CHANGE CONTROL
MANAGEMENT
 Objectives

1. Describe the importance of a change control

system.
2. Explain the change control management process.
3. Discuss change control management procedures.
4. Define configuration management, and describe
sample activities conducted as part of a
configuration management plan.
5. Describe organizational change management.
6. Describe the audit involvement in a change control
examination.
 Introduction
 Change Control Management refers to
the overall process that ensures effective
implementation of changes in an IT
environment

 Minimizes the likelihood of disruption,

unapproved changes, and errors
 Ineffective Change Controls

Per Government Accountability Office

(G.A.O.), ineffective change controls in audits
of federal agencies resulted in:
 increased costs
 diminished usefulness of risk assessments and
security plans
 unauthorized access
 increased difficulty to monitor access,
investigate security violations, and implement
effective security patches
Change Control Management
 What is considered a “change”?
 Updating personnel or customer information
 Generating specific (financial) reports for
Management’s decision making purposes
 Fixing bugs, adding new functionality,
implementing new software releases (vendor-
received updates)
 Enhancing systems, improving the GUI
Changes can also result from configuration
management and business process redesign.
 Change Types
 Routine changes –
 minimal impact on daily operations
 can be implemented and/or backed out quickly
 Nonroutine changes –
 greater impact on operations
 may affect many users and have lengthy, complex
implementation and back out procedures
 Emergency changes –
 major/minor changes made quickly, without
following standard change control procedures
 must be approved by management before they are
undertaken or implemented
Change Control Mgt. Process

 Reduces system interruptions

 Minimizes the number of back outs
 Allocates staff effectively
 Allocates system time efficiently
Change Control Mgt. Process
 Covers the following:
 Requesting the change
 Assessing the impact of the change
 Implementing controls
 Handling emergency changes
 Revising and updating change documentation
 Authorizing maintenance changes
 Approving software releases
 Ensuring adequate distribution of software

Change Control Management should be part of

an Organization’s policies & procedures!
 Requesting the Change

 Ensures that only authorized changes are

made
 Requires that:
a record is kept of all changes to the system
 appropriate resources are allocated
 changes are prioritized, and approved by Mgt.
 Changes are prioritized in terms of:
 benefit
 urgency
 effort required
 impact on existing operations
Change Request Form
 Impact Assessment

 Ensures:
 that negative consequences from
implementing the change are identified and
planned for
 compliance with existing policy, procedures,
and processes
 Changes can introduce risk to the
availability, integrity, confidentiality, and
performance of a system.
 Implementing Controls

 Implemented via manual processes and/or

automated tools
 Ensure:
 that authorized changes were made
 detection of unauthorized changes
 reduction of errors
 reliability of changes
 Examples of controls include:
 independent verifications of the success or
failure of implemented changes
 detection of unauthorized changes
 Controls: What they do?

 Ensure segregation of duties (SoD) between who:

initiates approves implements

 This avoids implementing unauthorized changes into

a live/production environment (risk)

 Each change implemented ✓ Identified

should be: ✓ Categorized
✓ Prioritized
✓ Assessed for impact
✓ Authorized
 Emergency Changes

 Changes that are required outside of the

prescribed schedule
 Normally required to fix errors in functionality
that adversely effect system performance or
business processes
 Pose increased risk as they bypass standard
procedures of the traditional CCM process.
 Asa result, auditors should pay particular attention to
emergency changes
 Change Documentation

 Changes require existing documentation

and procedures to be updated to reflect
the nature of the change.
 Current documentation minimizes
reliance on individual staff.
 Maintenance Changes

 Example: defragmenting a hard disk to remove

fragmented files or lost clusters
 These are also considered changes, and should
be accounted for and subject to CCM process
and procedures.
 Software Releases

 Also require management approval to ensure

that the release (change) is properly
authorized, tested, and documented before it
is implemented in the production
environment.
 Software Releases

 Controls to implement:
o backups of system’s data and programs
o version control to track version files
o ensure software releases are received from valid
sources
o “formal hand-over process” (i.e., only authorized
personnel implement the new/updated releases;
not programmers)
 Software Distribution

 Ensures that copies of the software are

distributed in accordance with their license
agreements
 Minimizes the risk of multiple versions of the
software being installed at the same time
(software integrity)
 Violating SW agreements has legal
ramifications for companies like:
 costs for installed copies not licensed
 damages and legal fees
 loss of corporate reputation
Change Control Mgt. Procedures

In place to ensure that members

of an organization follow the
CCM process
Change Control Mgt. Procedures

 Areas to consider when developing

change control management procedures:
 Objectives and Scope
 Change Control Mgt. Board/Committee
 Criteria for Approving Changes
 Post-implementation
 Points of Change Origination and
Initiation
 Approval Points
 Changes to Documentation
 Review Points
 Objective and Scope
Objectives:
 Reason(s) for the change
 Who request the change / Who will make the change
 Risk and impact of the change
 Fall back plans and back up procedures

Scope:
 Hardware, Operating system, Applications, Database
 Network (LAN, WAN, firewalls, servers, etc.)
 Facilities environment
 CCM Board/Committee

Entity that coordinates and communicates

changes within an organization

Representatives from IT functions and key

user representatives
Review and approve changes
 Criteria for Approving Changes

Before approving change, CCM evaluates:

 Performance and availability of each system in
the production environment
 Change level factors (risk, impact,
communication requirements, install time,
documentation requirements, and
education/training requirements)
 Availability of people, time, and system
resources
 Criticality of the change
 Post-Implementation

Management’s evaluation once changes have

been approved and implemented include:

 Were change procedures followed?

 Did changes meet their objectives?
 Were implementation and back out
procedures adequately performed?
 Was the change status updated (i.e., marked
as complete, in progress, failed, or
cancelled)?
Change Origination and Initiation

 Identify the users or groups of users who

initiate changes. Changes are typically
requested by:
 Vendors
 Computer Operators
 Application/System programmers
 End-Users

 Determines the urgency and priority of each

request.
 Approval Points

 Approval points throughout the change

control process should occur at:
 Requesting the change
 Testing the change

 Implementing the change in production

 Changes to Documentation

 Organization should maintain a record of

all the changes made to the system (e.g.,
CRFs, approvals, programmer’s
documentation, etc.) for future
maintenance.
 Review Points

 CCM procedures should be carefully

reviewed if changes to the system are to be
successfully implemented.
 Periodic CCM meetings review:
 Pending changes
 Notification to all interested parties
 Implementation reports, etc.
 CCM procedures should be documented in
the form of an organizational policy (see
Appendix 6)
 Configuration Management

 Controlling the physical inventory …

among components that form a set of
“baseline” objects that are subject to
change.
 NIST’s Software Configuration Mgt.:
 Totrack the different versions of the software
and ensure that each version of the software
contains the exact software outputs generated
and approved for that version.
 Change Control Tools

 KONFIG® Configuration Management

(KONFIG CM)
 HP Change and Configuration Center
 TurnOver Change Management
 IBM Tivoli ®
 MKS Integrity for Application Life-cycle
Management
Organizational Change Management

 the organization’s ability and methods for

adopting, managing, and adapting to
change.
 An IT project is actually considered a
“product of the organization’s culture”.
1. Organizational Culture
2. Managing Organizational Change
 Organizational Culture

Policies and procedures, including:

 Structures for incentives:
 incentivescan impact the success of the
organization in adapting to change
 Politics:
 political influences over organizational change
 Organizational and technical support:
 supporting the organization’s infrastructure and
key staff
 Inter-organizational relationships and social
networks
 senseof community may ensure adoption of the
change
 Managing Change

 Includes people, organization, and culture.

 To facilitate the change process, users
should be involved in the design and
implementation of the business process
and the system.
 Communication, training, and
professional development plans are also
key in managing organizational changes.
 Audit Involvement

Audit Goal…

To ensure that changes implemented

do not adversely affect system,
application, or data confidentiality,
integrity, availability (CIA).
 Audit Involvement

Why do you think change

management controls are
important to IT auditors?
 Ineffective Change Controls
Other results: programmers
could modify
security features program code to
could be bypass access to
inadvertently or sensitive data…
deliberately omitted
or “turned off”…
erroneous
processing could
be perpetuated…

malicious code viruses could

could be be introduced
introduced… disrupting
processing…
 Audit Involvement
 Auditors will determine (and test
against) whether change control
management procedures were carried on,
and changes were adequately:
 Authorized
 Tested
 Documented
 Communicated
 Controlled
 Examples of Audit Procedures

 Obtain copies of P&P’s on change management

 Interview staff about the procedures to
implement changes
 Obtain copies of change request form and logs
 Select a sample of the changes logged (1) to
determine compliance with P&P’s and best
practices, and (2) to trace back to change
control request logs.
 Determine proper authorization of new software
or changes
Examples of Audit Procedures
(cont’d.)
 Determine proper testing took place
 Determine test results were reviewed and
approved before implementing change into
the production environment
 Test that program and file names are properly
controlled to avoid duplicate names
 Inspect all supporting documentation and
determine that it is updated accordingly
before implementation into production
END OF CHAPTER 10