M4 S2 ISC CPA Change management

Change Management

The policies, procedures, and resources employed to govern change in an organization

• Usually have an impact on IT infrastructure such as internal hardware, software applications, and governance

Development Phase

perform initial code revisions, which would be part of the development environment.

Configuration

Process of modifying the default system parameters to meet a company's needs. Configuration should be performed according to the implementation roadmap and approved system changes

Baseline

Represents a formally reviewed and accepted configuration of system settings, software, and state that serves as a reference point or starting point for reconfigurations. Once established, changes to the baseline can only be made through formal configuration and change management processes to maintain control and consistency.

Agile Method

Change management methodology that was created to address shortfalls of the Waterfall method, another methodology used to implement change. The Agile method has a more flexible approach that is distinguished by its use of cross-functional teams that are dedicated to different functions and improvement initiatives that are tied to a list of the end customer's prioritized needs.

The steps listed in Savestone Solution's mechanized process for completing updates aligns with the core Agile principles, which include satisfying customers early with continuous delivery of high-priority features, welcoming change, meeting frequently to make adjustments, and completing only work requested by the customer.

Change Management Process

A process an organization can keep up with changing application and hardware needs without losing the ability to operate or achieve its strategic objectives

• Steps to manage change:

  1. Identify and define system change

  2. Design high-level plan to be achieved because of change

  3. Obtain approval from management for the change

  4. Develop appropriate budget & time line

  5. Assign personnel responsible for managing the change

  6. Identify/ address potential risks that could occur during the change

  7. Provide implementation road map

  8. Provide necessary resources and train personnel

  9. Test the system change

  10. Execute the implementation plan

  11. Review and monitor change implementation and test

Development Environment

Form of environment where software programmers write code to create application prototypes

• Source code editing tool is used to create and modify code syntax, automation tools that have preconfigured code, and a debugging

tool to help fix errors

• Revisions are made

Testing

Form of environment where developers test and debug code to identify errors that need to be corrected

• Intentionally separate from Development environment so the focus is on debugging errors in an application that is mostly complete

Staging

Form of environment where organizations can test programs that are in their final phases of development in a production-like environment

• Tests functionality, compatibility, security, and performance prior to deployment

Production

Form of environment where an application is deployed and made available to end users.

Change Management Risks

Component in the change management process where potential risks that can occur are identified as a result of a change

• To combat, AICPA Trust Services Criteria can be applied

1. Selection & Acquisition Risk

   1. Lack of expertise

   2. Lack of formal selection & acquisition process

   3. Software/ hardware vulnerability & incompatibility

2. Integration Risks

   1. User resistance

   2. Lack of management support

   3. Lack of stakeholder support

   4. Resource concerns

   5. Business disruption

   6. Lack of system integration

3. Outsourcing Risks

   1. Lack of organizational knowledge

   2. Uncertainty of the 3rd party’s knowledge and management

   3. Lack of security

Change Management Controls

Controls designed to minimize the possibility that the inherent risks will cause business disruptions or negatively impact IT systems

1. Policies and Procedures ←- Outline change management policy

2. Emergency Change Policies ←- Contingency policies/ procedures

3. Standardized Change Request Forms

4. Impact Assessment

5. Authorization

6. Standardized Change Requests

7.