GRC
HR
SCM
CRM
BI


Blog

 

Simplifying the SAP IT Change Management Audit

by Rick Porter

July 6, 2012

This post starts a new series of blogs on the topic of simplifying an SAP IT change management audit through change control automation. In this post I will discuss the general rationale and scope of an IT audit and introduce the key elements of an IT change management audit. Over the next few posts I will be drilling down into the detail within each key element and discuss the value change control automation in simplifying the audit process.

IT change management audit scope

Change management is the process by which SAP system changes are requested, planned, scheduled, developed, tested, accepted and finally applied. Since each change has the potential to disrupt a stable productive system, it is necessary that each change be controlled through its lifecycle in a repeatable, auditable manner. The reason behind this being an auditable (in many organisations a regulated) activity is because, any exceptions to the process may result in serious disruptions to production costing organisations many millions of dollars very quickly – in effect it is a risk management strategy.

To cover off all aspects of change management the scope of an audit will include the following:

  • Review of change management process documentation, policies and procedures;
  • Evaluation of the change management processes including change request application, development, build test and deploy process, change acceptance and authorisation to production; and
  • Security evaluation around who is authorised to do what - such as develop changes, approve testing of changes, authorise a change into production, classify changes (standard or emergency for example) or have access to systems to make changes.

Key elements included in an IT change management audit

There are a number of key elements included in an IT change management audit that we will be discussing in some detail over the coming issues. Each element is critical to effective change management and ensures changes are developed, tested and deployed in a controlled and authorised manner.

Element 1: Change management policies and procedures

Reviews formally documented change management processes and ensures the processes have been and are being followed for each change introduced into the system.

Element 2: Change initiation and approval

Reviews change request initiation and approval processes to ensure each change is initiated in a formal manner and effectively approved.

Element 3: Development policies

Reviews the policies governing modification or development of code to ensure the development or modification is initiated in a separate system – away from QAS or Production.

Element 4: Testing and acceptance

Reviews testing procedures and testing processes to ensure changes are satisfactorily tested before being approved for migration into Production.

Element 5: Deployment

Reviews approval procedures for changes going into Production to ensure that only authorised changes are deployed.

Element 6: Change management process compliance

Reviews deployed changes relative to change management process to ensure all deployed changes have complied with predetermined change management process.

Element 7: Emergency change management

Reviews process around the categorisation deployment of emergency changes to ensure emergency changes are properly managed even in emergency situations.

Element 8: S ecurity

Reviews security around the development and deployment of software changes to ensure only authorised personnel are making changes as per predetermined policy.

Additional considerations

One of the main objectives of the IT audit team is to make certain that changes actually made to the SAP systems do not differ from the changes as documented and so a clear link between the technical changes (SAP transports and object changes) and the change request detail must be demonstrable.

Next blog

In the next blog I will take a deeper look at the first few key SAP IT change management elements i.e. change management policies and procedures and change initiation and approval.

An email has been sent to:






More from SAPinsider



COMMENTS

Please log in to post a comment.

No comments have been submitted on this article. Be the first to comment!


SAPinsider
FAQ