IT Change Management - 4th Edition

IT Change Management - 4th Edition

This document focuses on IT change management, a critical process for ensuring that technology changes to systems, applications, and programs are implemented in a controlled, effective, and secure manner.

As organizations increasingly rely on digital technologies, automation, and cloud-based solutions, the volume and complexity of changes continue to grow, making strong change management controls a key component of IT governance and IT general controls (ITGCs). Effective change management helps organizations reduce risk, minimize unintended consequences, improve service quality, and ensure that systems operate as intended.

The guide emphasizes that accountability for change management extends beyond the IT function to senior management and the board, which are responsible for overseeing and managing related risks. It also highlights the role of internal audit in evaluating the effectiveness of change management processes and supporting improvements in governance, risk management, and controls.

Additionally, the document provides practical guidance and an audit approach to assess change management and patch management practices, helping internal auditors evaluate process maturity, identify weaknesses, and determine whether stronger controls and governance mechanisms are needed.