Framework

COBIT: what it asks of a production change

COBIT is where the change-management detail behind a SOX IT general control is written down: BAI06 (manage IT changes) and BAI07 (manage change acceptance and transitioning), with DSS06.03 for roles and segregation of duties. It shows whenever SOX 404 is ticked.

Our statement of each clause, read against the copy we hold and cited to it; it is not the instrument's verbatim wording.

The findings it sits behind

9 clauses cited

Finding	Clause
No independent approval	COBIT BAI06.01
Approved after it shipped	COBIT BAI06.01 · COBIT BAI07.06
Automated author, no human approval	COBIT BAI06.01 · COBIT BAI03.08
Deployed their own change	COBIT DSS06.03 · COBIT BAI07.06
One person, three roles	COBIT DSS06.03
Emergency, no approval after	COBIT BAI06.02
Deployment with no matching change	COBIT BAI06.03 · COBIT BAI10.03
No ticket reference	COBIT BAI06.01 · COBIT BAI06.04
Approver not on the list	COBIT DSS06.03
No test evidence	COBIT BAI07.05 · COBIT BAI03.08

Every COBIT 2019 clause the checker cites

Run the specimen Check your own change log