Change Management Exercise (AI6 and AI7)
The CoBIT framework is a tool available to help organizations establish / evaluate their change control process. CoBIT control objectives AI6 (Manage Changes) and AI7 (Install and Accredit Solutions and Changes) relate to the change management process and to this assignment.
Please use the .pdf file named “CoBIT Control Practices” to help you with this assignment. If you are unfamiliar with how to use CoBIT, you’ll want to first locate the appropriate control objective (for example, AI6). Then, look find the shaded box labeled “Control Practices” * Control Practices are procedures a company should have in place to achieve and efficient and effective system. Thus, it is helpful to reference these practices when assessing a company’s change management procedure.

* You will need to reference CoBIT while performing this assignment.

* For full credit, identify 10 change management deficiencies, the risks associated with each, and your suggestion for improving each identified deficiency.

The Setting
Tampa Autoparts Corporation (TAC) is a manufacturer of various automotive components, located in the Tampa Bay area. In operation since the early 1960s, TAC has grown rapidly over the years, with its customer base comprising service stations and auto parts stores all over the Southeastern United States. The company has a custom-developed information system for meeting the accounting and reporting needs of all departments. The system was initially developed in COBOL in the 1970s, but was ported to a C++ object-oriented environment in 2002. The IT department, led by Mr. Rick Wakeman, has a team of ten programmers, five systems analyst, three quality assurance specialists, and two computer systems operators.
In the last six months, there have been two major problems with TAC’s information systems, both of which were subsequently traced to faulty program changes. In one case, a change to the payroll processing module resulted in overtime pay being miscalculated with underpayments to 26 employees. In a second case, a change to the online sales order processing module implemented late on a Friday afternoon resulted in the system crashing on Friday night and consequently no sales orders could be processed over the weekend until the problem was corrected the following Monday. This disruption caused the loss of revenue to the tune of approximately $400,000, since many service stations and auto parts stores were in the habit of placing their replenishment orders for depleted stock on Saturday.

You have been hired as an information systems auditor in TAC’s internal audit department. Ms. Stevie Nicks, the head of the internal audit department, has asked you to review the change management process in the IT department. Based on your review of existing documentation and interviews of personnel in user departments and the IT department, you have ascertained the following facts: 1. Every month, two programmers and a systems analyst conduct an “open house” that can be attended by users from any department. During these sessions, users can suggest changes to the system. Each user-suggested change is discussed during such sessions, with the analyst and programmers asking detailed questions about the nature of the change requested. Upon mutual agreement between users and the programmers and analyst, changes that are viewed as being worthy are noted down by one of the programmers. This list of changes is shared with programmers, who then select the changes to make based on their area of programming expertise. As the programmers make the changes, the modified programs are tested on servers in the IT department. Before these changes are moved to the production server, they must be approved by Mr. Wakeman who sends an email to the computer operator with a list of approved changes that can be moved to the production server. 2. At the last meeting of departmental managers, which is always attended by Mr. Wakeman, he had to deal with complaints from two of the managers who felt that changes suggested by their users at an open house session were not handled on a timely basis. These managers felt that the changes requested by their users were important and should have received attention over other changes made that the managers felt were relatively trivial in comparison. 3. There are occasions when users detect issues that they feel require urgent changes to the system. In such cases, users appeal to their department head to personally call Mr. Wakeman explaining the basis for their change request. If satisfied that the change must be made quickly, Mr. Wakeman calls the chief programmer, who in turn directs one of the other programmers to perform the change directly on the production server. This arrangement has proved popular with users since their urgent change requests are handled very quickly. 4. Curious about how the open house sessions operated, you decide to attend one. At this session, a user from the customer service department asked about the status of a change she had suggested that had “made the list” during an open house session three months ago. One of the programmers indicated that he would look into the matter. Another user from the purchasing department remarked that he absolutely loved the redesigned purchase order screen that had been implemented per his suggestion. His only issue, however, was that a newly hired purchasing agent was complaining about the mismatch between the screen and the documentation in the purchasing department’s operating manual. 5. You decide to interview the computer operators to learn about the process of actually implementing the changes on the production server. You are able to interview Mr. Roger Daltrey, who works Monday through Thursday (the other operator, Mr. Eric Clapton, works Friday through Sunday). When asked for documentation of implemented changes, Mr. Daltrey gives you a binder with all the emails from Mr. Wakeman approving the installation of routine changes. Flipping through the binder you note that in addition to Mr. Wakeman’s emails there are also emails from Ms. Natalie Merchant who is one of the quality assurance specialists. Mr. Clapton explains that the emails from Ms. Merchant deal with operating system patches and not program changes. Mr. Clapton was of the opinion that these patches “had to be done” and therefore did not require either testing or Mr. Wakeman’s approval. When asked whether installation of a patch had ever caused problems, Mr. Clapton could recall only one time when system response time had increased dramatically and it was determined that a patch conflicted with the antivirus program running on the server causing a spike in processor utilization. However, Mr. Clapton indicated that the problem was fixed within 48 hours. 6. As you are concluding your interview with Mr. Clapton, he relates a story to underscore his ingenuity. One emergency change that was implemented in the sales processing program pursuant to a phone call by Mr. Wakeman involved the reprogramming of the shipping and handling charges to be applied to sales orders for out of state sales. Unfortunately, although the change corrected calculated the new shipping and handling amount, it resulted in the miscalculation of the total sales order amount to out of state customers. Mr. Wakeman happened to be monitoring the sales order processing program on his terminal and was mentally calculating what the total amount should be for orders “just for fun.” He recognized the problem after about 20 sales orders had been processed and immediately called the programming department to determine how the emergency change could be “backed out.” Luckily, the programmer on duty was the one who had written the changed code and had the old version of the code on his computer. The programmer emailed the old code to Mr. Wakeman, who quickly reapplied the code so that the older version of the sales program was reinstated. As a result, there were only 20 sales orders for which adjusting transactions had to be created. Mr. Wakeman jokingly remarked that he deserved a pay increase for his ingenuity!

Required:
Refer to COBIT control objectives AI6 (Manage Changes) and AI7 (Install and Accredit Solutions and Changes). Fill in the following table, in which you should list the current TAC procedure for handling system changes, the risk stemming from that procedure, and your recommendation based on COBIT. Email this Word file to me at rmarley@georgiasouthern.edu when you are finished.

Current procedure at TAC | Risk relating to procedure | COBIT-based recommendation (reference specific COBIT control objective) | Managers feel changes are not being properly prioritizedEvidence: “These managers felt that the changes requested by their users were important and should have received attention over other changes made that the managers felt were relatively trivial in comparison.” | If changes are not properly prioritized, important changes may not be made on a timely basis. | Each change should be prioritized by the change management review board.(AI6, Control Practice #1, bullet 2). | 1. Status of changes is not documented wellEvidence: “A user from the customer service department asked about the status of a change she had suggested that had “made the list” three months ago. Was told they would look into it.” | Failure to comply with compliance requirements. Users could keep requesting the same change hoping that it will eventually be approved. | Each change request should be tracked and a status listed(AI6.4, Control Practice #2) | 2. There is not timely closure of changesEvidence: “Two of the managers who felt that changes suggested by their users at an open house session were not handled on a timely basis.” | If management does not feel their issues are being addressed in a timely manner, they may begin to find ways around the system or wait until the need becomes an emergency. | Ensure timely closure of changes(AI6, Control Practice # 4) | 3. Changes are not prioritized based on business risk. Evidence: “The list of changes is shared with programmers, who then select the changes to make based on their area of programming expertise.” | Important changes could not be made on a timely basis. | Each change should be classified and prioritized based on business risk(AI6, Control Practice #1, bullet #2) | 4. Version controls are not maintainedEvidence: “Luckily, the programmer on duty was the one who had written the changed code and had the old version of the code on his computer.” | If a change is not executed properly or there are problems with the execution, not having prior version controls could be very costly for the business. In this case, 20 sales orders had to be re-created but this could have been much worse. | Establish and maintain version control over all changes(AI6, Control Practice #2) | 5. Managers feel that there is favoritism in the changes.Evidence: These managers felt that the changes requested by their users were important and should have received attention over other changes made that the managers felt were relatively trivial in comparison.” | Management may find ways to override the system. The change process will not be trusted. | Implement change status reports with performance metrics to enable management review and monitoring of both the detailed status of changes and the overall state. (AI6.4, Control Practice #3) | 6. Implemented changes are not properly documented.Evidence: “When asked for documentation of the implemented changes, Mr. Daltrey gives you a binder with all the emails from Mr. Wakeman approving the installation of routine changes.” | Lack of documentation of business process. In addition, the business will not know how the changes were implemented in case they need to reverse them or make similar changes. | Ensure that documentation—including operational procedures, configuration information, application documentation, help screens and training materials—follows the same change management procedure and is considered to be an integral part of the change.(AI6.5, Control Practice #1) | 7. Emergency changes do not have a documented process. There is only a call to Mr. Wakeman | This can lead to changes being implemented that shouldn’t be or changes that could bring down the systems. | Ensure that a documented process exists within the overall change management process to declare, assess, authorize and record an emergency change.(AI6.3, Control Practice #1) | 8. An emergency change led to greater problems that were not expected and no review was in place.Evidence: Mr. Wakeman happened to be monitoring the sales order processing program on his terminal…” | This could lead to errors in the system that could be very costly to the company. | Conduct a post-implementation review of all emergency changes, involving all concerned parties. The review should consider implications for aspects such asfurther application system maintenance, impact on development and test environments, application software development quality, documentation and manuals, anddata integrity.(AI6.3, Control Practice #4) | 9. Staff members and user departments aren’t trained regarding changes.Evidence: A monthly open house is conducted to discuss changes. | This fails to promptly detect problems with systems and their users. | For systems development, implementation or modification projects, a training plan is an integral part of the overall project master plan. Ensure that the plan clearly identifies learning objectives, resources, key milestones, dependencies and critical path tasks impacting the delivery of the training plan. The plan should consider alternative training strategies depending on the business needs, risk level.(AI7.1, Control Practice #1) | 10. A documented emergency process for changes does not exist.Evidence: “In such cases, users appeal to their department head to personally call Mr. Wakeman explaining the basis for their change request….This arrangement has proved popular with users since their urgent change requests are handled very quickly.” | There is not a consistent procedure for emergency changes. In addition, users have become dependent on this procedure for changes that are not true emergencies. | Ensure that a documented process exists within the overall change management process to declare, assess, authorize and record an emergency change.(AI6.2, Control Practice #1) |