ITGC Standard Template

Workpaper
Year
Client
1. Changes are documented
2. Changs are authorized before development

3. Changes are tested

Control Description
4. Changes are approved before deployment to production

5. SOD is maintained in Change Management process

Testing Questionaries
Source of
Population
Population Size
IA observed the parameters used to extract the change listing and noted that no exclusionary
compared the screenshot of the query result to the output extract and noted tht the number o
output file are same. This gives comfort that the poupulation is complete and accurate

How Population is
assessed to be
complete and
accurate?
Sample Size 1
Sample size
rationale 1
Sample selection
procedure

Change Ticket# System

677686 UC4 v 12 Batch Job Scheduler-EU

HCM-CR000344 IBM code Migration

CHG0075040 Retail Billing System

Attribute details
Attribute A Changes are documented
 t6 z
Attribute B
Attribute C Changes are tested

Attribute D Changes are approved before deployment to production

Attribute E
SOD is maintained in Change Management process

Tickmark details
X No exception noted
Y Exception Noted
N/A Not applicable

Conclusion
Control Effectiveness

Was any deviation noted?

Explanation (only if any deviation is noted during the

controls testing and overall conclusion is still effective)
 ITGC Standard Template
ITGC Section Manage Change
Control Overview Change Management
Control Frequency
ed
before development

before deployment to production

hange Management process

Testing Questionaries

s used to extract the change listing and noted that no exclusionary parameters were used. IA further
of the query result to the output extract and noted tht the number of rows returned on output screen and the
gives comfort that the poupulation is complete and accurate

Attribute Testing Analy

Summary Developed by and Date
UC4-Hold jobs for Letters and Notices manual verification jose Ricardo Garfin,15/09/20121

Adam Bearden,04/11/2019 5:30 PM

The Machine Team June 2021 Release

Attribute details
ore deployment to production

nge Management process

Tickmark details

Conclusion
Ineffective
Attribute Testing Analysis
Tested by and Date CAB Approval date
Jose Richardo Grafin, 15/09/2021 Not appoved by CAB

Patrick Tucker,04/11/2019 5:40PM Patrick Tucker, 05/11/2019 4:58PM

 Migrated by and date Attribute A Attribute B Attribute C
Jose Rechardo Grafin,15/09/2021 6:42:49 AM EDT X X X

Wayne Holle,05/11/2019 6:14PM X X X

 Attribute D Attribute E
Y Y

X Y
Logical Access Management Standard Controls

ITGC SectionControl OverControl Type Control Description

1. Changes are documented
2. Changs are authorized before
development
3. Changes are tested
Manage ChanChange ManaPreventive
4. Changes are approved before
deployment to production
5. SOD is maintained in Change
Management process

The IT Department maintains and

monitors access to make changes (e.g.,
transports from the test environment,
Manage AcceChange MonitDetective
data imports, configuration
modifications, etc.) in the production
environment to authorized personnel.

Standard Sample Methodology

Frequency Population Sample Size

10% of total
population
Daily or
(minimum 5
more than 365+
and
daily
maximum
25)
Weekly 52 5
Monthly 12 2
Quarterly 4 2
Half yearly 2 2
Annual 1 1
Ad-Hoc As required
Logical Access Management Standard Controls

ITGC SectionControl OverControl Type Control Description

1. Changes are documented
2. Changs are authorized before
development
Manage ChanChange ManaPreventive 3. Changes are tested
4. Changes are approved before
deployment to production
5. SOD is maintained in Change
Management
transports fromprocess
the test environment,
Manage AcceChange MonitDetective
data imports, configuration

Standard Sample Methodology

Frequency Population Sample Size

10% of total
population
Daily or
(minimum 5
more than 365+
and
daily
maximum
25)
Weekly 52 5
Monthly 12 2
Quarterly 4 2
Half yearly 2 2
Annual 1 1
Ad-Hoc As required
Logical Access Management Standard Controls

ITGC SectionControl OverControl Type Control Description

1. Changes are documented
2. Changs are authorized before
development
Manage ChanChange ManaPreventive 3. Changes are tested
4. Changes are approved before
deployment to production
5. SOD is maintained in Change
Management
transports fromprocess
the test environment,
Manage AcceChange MonitDetective
data imports, configuration

Standard Sample Methodology

Frequency Population Sample Size

10% of total
population
Daily or
(minimum 5
more than 365+
and
daily
maximum
25)
Weekly -42 -89
Monthly -8 -18
Quarterly 0 -2
Half yearly 2 2
Annual 1 1
Ad-Hoc As required