6: Auditing Network change Mnagement

Question 1

• Change control policy

Answer 1

The IS auditor should examine the organization’s change control policy to understand how change is supposed to be controlled and managed.

Question 2

• Change logs

Answer 2

The IS auditor should determine if information systems contain automatic logs that contain all changes to systems and, if so, if these logs are reviewed by IT staff to ensure that only approved changes are being made to systems. The auditor should examine procedures and records to determine what actions are taken when unapproved changes are discovered

Question 3

. • Change control procedures

Answer 3

The IS auditor needs to examine change control procedures and examine records to determine if procedures are effective and are being followed.

Question 4

• Emergency changes

Answer 4

The IS auditor should examine change control policy, procedures, and records to see how emergency changes are handled and how they are approved.

Question 5

• Rolled-back changes

Answer 5

The IS auditor should examine change control records to see what changes needed to be rolled back because of problems. The auditor should determine how these situations were handled

Question 6

• Documentation

Answer 6

The IS auditor should determine whether change control procedures and records include updates to documentation, including network operations procedures, architecture diagrams, and disaster recovery plans.

Question 7

. • Linkage to system development life cycle (SDLC)

Answer 7

The IS auditor should understand how the organization’s system development life cycle is integrated with its change management processes to ensure that only completed and properly approved software changes are proposed for promotion into production.