Part 1
Change and Configuration Management
All system changes should be managed and controlled, and result in
outputs that are acceptable to the business.
Control objective Controls
1. Changes to IT systems Have the procedures for
should be controlled on changing ICT systems –
the basis of defined - been documented?
procedures - received appropriate
authorisation?
How are the procedures kept
up-to-date?
In respect of major changes,
do the procedures address
training needs?
2. Changes should specify How do management ensure
the components to be that only the correct system
changed, and also the components -
version where multiple - are changed?
versions exist - are installed following
change?
3. The risks associated How do management –
with change proposals - assess the risk inherent in
should be assessed and change proposals?
managed - act on risk assessments?
- establish whether a change
has been successful?
- restore stability following an
unsuccessful change?
C:\temp\Risks - Change & Configuration Management.doc
IP 14/10/2003 11:49 AM
Workbook
Risks – system malfunction
or failure due to –
- uncontrolled change
- unauthorised change
Discussion on –
- time, cost and quality
- the risks inherent in
changing IT systems
- configuration management
- documentation and
document management
- training
Discussion on –
- scoping changes
- version control
Discussion on –
- categorising system
changes
- impact analysis
- regression plans
 Part 1
Change and Configuration Management

Control objective Controls Workbook

4. System changes should Have top management Discussion on –
be authorised at an defined delegated powers to - delegated authority
appropriate level of authorise system changes? - System Ownership
management - end-user participation
Are changes to application
systems authorised by end-
user management?

Are end users consulted on

proposed changes to the IT
infrastructure?

5. Due regard should be Is there an effective Discussion on the need for

paid to an effective separation between the separation of roles in the
separation of roles in functions of – change management cycle
managing changes - authorising a change?
- recording a change? Emergency change
- building a change? procedures
- implementing a change?
- quality control?

Does an effective separation

of roles apply to emergency
changes?

2
 Part 1
Change and Configuration Management

Control objective Controls Workbook

6. Authorised changes Are all system changes
should be managed to recorded? Are all steps within
completion the change control procedure
recorded?
Are change records retained
for audit?
Does each change have an
“owner” or “sponsor” to take
key decisions?
Discussion on –
- recording changes
- back-tracking and auditing
- ownership of changes
- planning and scheduling
- control over re-work
- unauthorised changes
- training
- priority

Are authorised changes

planned and scheduled
according to business need?

How do management ensure

that all scheduled changes
are actually carried out?

How are unsuccessful

changes dealt with?

What ensures that system

changes do not bypass the
approved procedure?

7. Emergency changes How do management ensure Emergency change

should comply with that emergency changes – procedures – quality and
normal change - are implemented without security implications
management delay?
requirements as soon as - are of appropriate quality?
possible - do not result in abuse of the
change control system?

3
 Part 1
Change and Configuration Management

Control objective Controls Workbook

8. Changed components How do management ensure
should be fit for that system changes comply
business use with the appropriate
development standards?
How do management ensure
that system changes are of
acceptable quality to end-
users?
Discussion on –
- technical testing
- user acceptance testing
- system performance
- documentation
- post implementation review
- “Trojan Horse”/computer
virus

Does quality review include

all appropriate documentary
changes?

Are changes reviewed

following live implementation?

How would management

detect unauthorised
components incorporated
within an authorised change?

9. Configuration items Is the system configuration Discussion on –

should be recorded recorded in respect of – - configuration management
accurately - hardware?
- unauthorised change
- software?
- configuration auditing
- documentation?
- data communications
equipment?

Are the records

comprehensive?

How do management ensure

that configuration records are
promptly updated to reflect
system changes?

How do management protect

the records from unauthorised
change?

How do management ensure

the records are realistic?