Database changes: what the auditor reads in them
A schema change or migration touches the data behind the financial statements directly. Auditors read these rows closely for approval before the run and for test evidence.
How the checker recognises them
Read from the title and system: schema, migration, table, index, stored procedure and the like.
Findings they raise most often
- Approved after it shipped: What authorised this change to go to production at the time it went, given the approval on record is dated after?
- No test evidence: What testing was done before this change went to production, and where is the record?
The clauses that speak to them
3 clausesCOBIT BAI07.05 Perform acceptance testsThe clause text
Changes are tested independently according to the defined test plan before migration to the live environment: the categorised log of errors found by the development team is reviewed to verify remediation or formal acceptance; final acceptance is evaluated against the success criteria and results are presented understandably to process owners and IT for an informed decision; acceptance is approved with formal sign-off by process owners, third parties as appropriate and IT stakeholders before promotion; testing follows the plan and is designed and conducted by a test group independent from the development team; tests and expected outcomes follow the plan's success criteria; scripted test instructions are assessed and approved by the independent group; an appropriate balance of automated and interactive user testing is used; security tests measure weaknesses and consider security incidents since the plan was written; performance tests cover a range of metrics such as end-user response times and database update performance; fallback and rollback elements of the plan are addressed; and errors are identified, logged and classified with an audit trail of results and communication per the plan.
Where it usually falls short: Acceptance signed off with significant errors still open; Testing performed by the developers who built the change
Source: COBIT 2019
ISO 27001 8.32 Change managementThe clause text
Put changes to facilities and systems through change management procedures.
Where it usually falls short: Missing formal approval; No rollback plan documented
Source: ISO/IEC 27001:2022
SP 800-53 CM-4 Impact analysesThe clause text
Requires changes to the system to be analysed for their potential security and privacy impact before they are implemented, so that the consequences of a change are understood while it can still be stopped or modified.
Where it usually falls short: Analysis performed after deployment as part of a review rather than beforehand; Privacy impact never considered, only availability and security
Source: NIST SP 800-53 Rev 5