The IT Audit Checklist for Change Management includes:

• 187 specific checklist items to help assess your internal audit readiness
• Controls derived from prominent standards/frameworks including ITIL, CobiT, and NIST
• Pointers on audit planning, preparation, testing, and reporting
• Clarification on what auditors want (and don't want) to see

What Is This Paper About?

This paper, "IT Audit Checklist: Change Management," supports an internal audit of the organization's change management policies in order to verify compliance and look for opportunities to improve efficiency, effectiveness, and economy. The paper includes advice on assessing the existence and effectiveness of change management in project oversight, development, procurement, IT service testing, and IT operations; guidance for management and auditors on supporting change management; and information on ensuring continual improvement of change management efforts.

Authors

George Spafford is Principal Consultant with Pepperweed and an experienced practitioner in business and IT operations. He is a prolific author and speaker, and has consulted and conducted training on regulatory compliance, IT Governance, and process improvement in the U.S., Australia, New Zealand and China. Publications include co-authorship of "The Visible Ops Handbook." George Spafford's Daily News is read by over 2,500 subscribers, including high-level executives from Fortune 500 and leading international companies. George holds an MBA from Notre Dame, a BA in Materials and Logistics Management from Michigan State University and an honorary degree from Konan Daigaku in Japan. He is a Certified Information Systems Auditor (CISA) and holds ITIL Practitioner Release and Service Manager certifications. George is a current member of ISACA, the IIA, and the IT Process Institute.

Dan Swanson, CMA, CIA, CISA, CISSP, CAP, is a 26-year internal audit veteran and former director of professional practices at the Institute of Internal Auditors. Swanson has completed internal audit projects for more than 30 different organizations, spending almost 10 years in government auditing, at the federal, provincial, and municipal levels, and the rest in the private sector, mainly in the financial services, transportation, and health sectors.

He has completed more than 50 IT conversion audits and a dozen comprehensive audits of the information technology function. The author of more than 150 articles on internal auditing and other management practices, Swanson is currently a freelance writer and health information security officer during the day. He can be reached via email at This e-mail address is being protected from spambots. You need JavaScript enabled to view it .

Series Editor: Cass Brewer