Definition
In an IT context, change management is the process for controlling changes to programs, configurations and data structures. A sound process includes a documented request, testing, approval by someone other than the developer, separation of development and production environments, and restricted access to move code to production.
Why it matters in an audit or review
Unmanaged changes can alter calculations, reports and interfaces without notice. The auditor tests change management when relying on automated controls or reports from the system, to support the conclusion that the control tested at one point operated the same way all year. A population of changes is selected from system logs, not from a list provided by IT, so that unauthorized changes would show up.
Example
The auditor wants to rely on an automated depreciation calculation. The auditor extracts all changes to the fixed-asset module from the system change log for the year (illustrative: 14 changes), samples 5, and checks for a ticket, test evidence and approver for each. One had no test evidence, so the team expands the sample before concluding.
Common mistakes
Selecting changes from a ticket list instead of from the system, which would miss changes made outside the process.
Sources
- AICPA, AU-C Section 315, Appendix on IT general controls (as amended by SAS No. 145)
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error