SOX Change Log Checker
Change type

Database changes: what the auditor reads in them

A schema change or migration touches the data behind the financial statements directly. Auditors read these rows closely for approval before the run and for test evidence.

How the checker recognises them

Read from the title and system: schema, migration, table, index, stored procedure and the like.

Findings they raise most often

The clauses that speak to them

3 clauses
COBIT BAI07.05 Perform acceptance tests
The clause text

Changes are tested independently according to the defined test plan before migration to the live environment: the categorised log of errors found by the development team is reviewed to verify remediation or formal acceptance; final acceptance is evaluated against the success criteria and results are presented understandably to process owners and IT for an informed decision; acceptance is approved with formal sign-off by process owners, third parties as appropriate and IT stakeholders before promotion; testing follows the plan and is designed and conducted by a test group independent from the development team; tests and expected outcomes follow the plan's success criteria; scripted test instructions are assessed and approved by the independent group; an appropriate balance of automated and interactive user testing is used; security tests measure weaknesses and consider security incidents since the plan was written; performance tests cover a range of metrics such as end-user response times and database update performance; fallback and rollback elements of the plan are addressed; and errors are identified, logged and classified with an audit trail of results and communication per the plan.

Evidence an auditor expects: Independent acceptance test results against success criteria; error log with remediation or acceptance; formal sign-off before promotion
Where it usually falls short: Acceptance signed off with significant errors still open; Testing performed by the developers who built the change
Source: COBIT 2019
ISO 27001 8.32 Change management
The clause text

Put changes to facilities and systems through change management procedures.

Evidence an auditor expects: Change requests; Change approvals; Implementation testing; Post implementation reviews
Where it usually falls short: Missing formal approval; No rollback plan documented
Source: ISO/IEC 27001:2022
SP 800-53 CM-4 Impact analyses
The clause text

Requires changes to the system to be analysed for their potential security and privacy impact before they are implemented, so that the consequences of a change are understood while it can still be stopped or modified.

Evidence an auditor expects: Impact analysis records attached to change requests before implementation; Method or checklist used to assess security and privacy impact; Examples of changes rejected or modified because of the analysis; Evidence that the analysis considers privacy as well as security effects
Where it usually falls short: Analysis performed after deployment as part of a review rather than beforehand; Privacy impact never considered, only availability and security
Source: NIST SP 800-53 Rev 5

Other change types

Run the specimen Check your own change log