Fox & Sons Company:IT Change Management Policy Presentation

Britt Bouknight Caitlyn CarneyXiaoyue JiuAbey P JohnDavid Lanter Leonardo Serrano

Why do we need this policy?• Purpose & Objectives:• Govern the change management process at Fox & Sons Co.• Ensure that:

• Business processes not disrupted by changes • Minimize impact of change incidents • Mitigate the exposure to risks • Rapid response to changing regulations and requirements• Enhance communication effectiveness

• Applies to:• All IT personnel• Business unit management teams• Executive Directors

Key Guidelines & Procedures • 1.01 & 1.10 Documentation• 1.02 Risk Management & Change Classification• 1.03 Testing• 1.04 Version control • 1.05 Approval• 1.06 Changes Affecting SLA’s• 1.07 Communicating changes• 1.08 Implementation• 1.09 Fallback• 1.11 Business Continuity Plans• 1.12 Emergency Changes• 1.13 Change monitoring

Roles & Responsibilities

• Change Management Board

• Change Management Manager

• Application Owners

• Developers/ Programmers

References & Questions• References• Internal References:

• Information Security Policy, #13.09.05

• External References (Compliance & Audit) :• COBIT 5 (AI6.1, AI6.2, AI6.4, AI6.5, AI6.2)• ITAF Audit/Assurance for Change Management (2.5.1)

• Questions?• Please Contact: Change Management Manager -

CMManager@fox.com

Change Management Quick Detail

Question

During a change control audit of a production system, an IS auditor finds that the change management process is not formally documented and that some migration procedures failed. What should the IS auditor do next?

Possible Answers:

A. Recommend redesigning the change management process.

B. Gain more assurance on the findings through root cause analysis.

C. Recommend that program migration be stopped until the change process is documented.

D. Document the finding and present it to management.

Explanation:

A change management process is critical to IT production systems. Before recommending that the organization take any other action (e.g., stopping migrations, redesigning the change management process), the IS auditor should gain assurance that the incidents reported are related to deficiencies in the change management process and not caused by some process other than change management.