Change management audits are an independent evaluation that provides management with information on the design and operational effectiveness of existing change management controls. This helps identify any weaknesses in the design of the controls and is essential when making changes to large networks. The post-change verification process must incorporate delays or convergence tests that are not necessary for pre-implementation testing in a small test environment. In some cases, planning and approval may be managed by the change manager and not involve the Change Advisory Board (CAB).
The emergency change management process should focus on making the change as quickly as possible, taking into account the risk of aggravating the problem. The change management controls of the service organization will be reviewed as part of the control objectives and common criteria for SOC 1 and SOC 2 reports, as needed. People in these teams may be responsible for managing change within a specific organizational unit, taking into account their experience, skills, and background. Simple, low-risk changes and service requests with a well-defined execution procedure do not require evaluation by change management and may only require approval from the applicant's line manager. Some models focus on changing the individual as a method of cultural change, while others have structures and frameworks to move the entire organization towards focused change and improvement. The first step in the network change management process should be to assess the scope of the proposed change.
For example, if a user entity requested a change to customize its software functions, a complementary user entity control would consist of the user entity testing, accepting, and approving the change before implementing it in the production environment. Normal changes represent a moderate risk to the continuity of the service and will involve calling on the CAB to be evaluated and planned according to a comprehensive change management process. Without this distinction, all changes (no matter how small) must go through the entire process, which may involve linking people to trivial changes, while more important changes can be delayed. ITIL recommends implementing change management in conjunction with configuration management. However, it is not necessary to implement 100% of configuration management before starting with change management. To maintain momentum, it's important to report on the business value offered by the change management function. Change management audits are an invaluable tool for organizations looking to make changes to their systems and technologies.
They provide an independent assessment of existing controls that can help identify any weaknesses in their design. Additionally, they can help ensure that post-change verification processes are properly implemented when making changes to large networks. Furthermore, they can help organizations manage emergency changes quickly while taking into account any risks associated with them. Finally, they can help organizations implement change management in conjunction with configuration management while reporting on any business value offered by this function.
