What it is
Change controls keep unauthorized or untested changes from reaching production. This checklist is for control owners to confirm that standard change, emergency change, the system development life cycle, direct data changes and key configuration changes are covered, before testing begins.
Each control point has a yes or no and an evidence reference, and the last section collects gaps and actions. For testing a sample of changes, use the change management test worksheet.
When to use it
- Before ITGC testing.
- After a new system, a migration or a change in the IT team.
- When emergency changes become frequent.
What’s inside
- Standard change control points
- Emergency change control points
- SDLC controls for new systems and major changes
- Direct data and configuration changes, gaps and sign-off
Standard cited
This template follows ITGC / COSO control activities. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Why separate emergency changes?
They bypass the normal approval and testing, so they are the usual route for control abuse. A definition, a log, time-limited access and approval after the fact keep them accountable.
Do configuration changes need the change process?
Changes to settings that drive financial results, such as approval limits, tolerances, tax tables and pricing, can change outcomes as much as code can, so they should follow the same process.
Related templates
- SOX Change Management Test Worksheet
- Risk and Control Matrix: IT General Controls
- SOX ITGC Test Plan
- Privileged Access Review Checklist
Last updated 11/05/2026. All free templates.