Change authorization and approval
Requiring documented requests and business and IT approval for changes to in-scope applications, interfaces, databases and infrastructure, and how auditors trace a sample of changes to approvals.
Program changes
IT general controls that make sure changes to financially significant applications, configurations and infrastructure are authorized, tested and approved before reaching production.
Change testing before production
Testing and user acceptance of changes before deployment to financially significant systems, and the evidence of test results and sign-off that auditors inspect.
Developer access to production
Separating development, test and production environments and keeping developers from deploying their own changes to financial systems, or monitoring them where full separation is impractical.
Emergency changes
Handling urgent fixes to financially significant systems outside the normal change process, with restricted access and approval and review after the fact.
Detecting unauthorized changes
Detective controls that reconcile changes found in production, for example from system logs, compile dates or file integrity monitoring, to approved change tickets.
Configuration and parameter changes
Controls over changes to application configuration, tables and parameters that drive automated calculations, matching and approval workflows in financial systems.
