Change Management Processes and Controls

Change management is a structured process for controlling modifications to information systems and infrastructure. For CISA candidates, change management is one of the most heavily tested topics because it directly affects system integrity, availability, and security.

The Change Management Process

Change Request

All changes should begin with a formal change request that documents what is being changed, why the change is needed, and who is requesting it. Every change, regardless of size, should have a documented request to maintain an audit trail.

Impact Assessment

Before approval, the change should be assessed for its potential impact on:

System functionality and performance
Other systems and interfaces
Security posture and compliance status
Business operations and users
Resource requirements for implementation and testing

Change Approval

Changes should be reviewed and approved by a Change Advisory Board (CAB) or designated authority. The approval should consider the risk of the change, the adequacy of testing, the implementation plan, and the rollback strategy.

Testing

All changes should be tested in a non-production environment before deployment. The extent of testing should be proportional to the risk and complexity of the change. Regression testing is particularly important to verify that the change does not negatively affect existing functionality.

Implementation

Changes should be implemented according to the approved plan, during approved maintenance windows when possible. Implementation should be performed by authorized personnel with appropriate access, and all activities should be logged.

Post-Implementation Review

After implementation, the change should be verified to confirm it achieved its objectives without unintended side effects. Any issues should be documented and addressed promptly.

Change Categories

Standard Changes: Pre-approved, low-risk changes that follow established procedures (e.g., applying routine patches).
Normal Changes: Changes that follow the full change management process, including CAB review and approval.
Emergency Changes: Changes that must be implemented urgently to resolve critical issues. These follow an expedited process but require retrospective documentation and approval.

Key Controls

Segregation of Duties: The person requesting or developing a change should not be the same person who approves or implements it in production.
Documentation: Complete records of all changes, including request, assessment, approval, testing, and implementation details.
Audit Trail: Logs that record who made each change, when, and what was modified.
Rollback Plan: A documented plan for reverting the change if implementation fails or causes unexpected issues.

Audit Considerations

IS auditors should verify:

A formal change management policy and process exist and are followed
All changes have documented requests, approvals, and test results
Emergency changes are subject to retrospective review and approval
Unauthorized changes are detected and investigated
Change success rates are tracked and reported to management

CISA Exam Focus

Change management questions appear frequently on the exam. Focus on understanding the complete change lifecycle, the importance of segregation of duties, and the controls required for each change category. A common exam scenario involves identifying what went wrong when a change caused a production outage, with the answer typically pointing to a control gap such as inadequate testing or missing approval.