Change management audit program.
How to audit whether changes to IT systems are requested, assessed, approved, tested and documented, and whether any change bypasses the procedure.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether changes to productive IT systems are made in a controlled way: with a request, an assessment of impact, approval before implementation, a test, a rollback plan and documentation. It also assesses whether all changes actually go through the procedure.
Scope
- Changes to applications, infrastructure, configurations and network components in production
- Standard changes, normal changes and emergency changes
- Roles in the procedure, such as requester, approver and implementer, and the development, test and production environments
- Out of scope: the methodology of software development itself, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A change process exists, is approved and distinguishes standard, normal and emergency changes. | BSI OPS.1.1.3; ISO/IEC 27001:2022 Annex A 8.32 | Read the process description and check whether categories, roles and flows are defined for each category. | Process description with approval, catalogue of standard changes |
| 2 | Every change is requested with a description, justification, affected systems and rollback plan. | BSI OPS.1.1.3 | Select ten changes from the last six months and check the requests for completeness. | Change requests or tickets |
| 3 | Impact and risks, including for information security, are assessed before approval. | ISO/IEC 27001:2022 Annex A 8.32 | In the sample, check whether and how impact and security aspects were assessed. | Assessment notes, risk rating in the ticket |
| 4 | Changes are approved by an authorised body before implementation. | ISO/IEC 27001:2022 Annex A 8.32 | Compare the time of approval with the time of implementation and check the authority of the approvers. | Approvals with timestamp, list of authorities, minutes of the change board |
| 5 | Requester, approver and implementer are separated, and development, test and production are separated from each other. | ISO/IEC 27001:2022 Annex A 8.31 | Compare the roles in the sample and check access rights to the environments. | Role matrix, authorisation extract of the environments |
| 6 | Tests and a documented acceptance take place before go-live. | BSI OPS.1.1.3 | For the sample, review the test plan, results and acceptance. | Test records, acceptance notes |
| 7 | A rollback plan exists and is tested, or at least reviewed, for critical changes. | BSI OPS.1.1.3 | Read the rollback plans of the sample and, for failed changes, check whether they were applied. | Rollback plans, records of failed changes |
| 8 | Emergency changes follow defined criteria and are approved and documented retrospectively within a deadline. | BSI OPS.1.1.3 | Select all emergency changes of the last half year and check justification, retrospective approval and documentation. | List of emergency changes, retrospective approvals |
| 9 | After a change, configuration and system documentation are updated. | ISO/IEC 27001:2022 Annex A 8.9 | In the sample, check whether the configuration management contains the changed data. | Extract of configuration management before and after the change |
| 10 | All actual changes go through the procedure; unrecorded changes are detected. | ISO/IEC 27001:2022 Annex A 8.32 | Compare system logs, deployments and configuration changes for a period with the change requests. | System logs, deployment logs, reconciliation list |
| 11 | Affected parties are informed in time and maintenance windows are agreed. | BSI OPS.1.1.3 | Check the communication on the changes in the sample. | Announcements, maintenance calendar |
| 12 | Access to make changes in production is limited to authorised people and is logged. | ISO/IEC 27001:2022 Annex A 8.2 | Extract the people authorised to change production, compare them with the roles and check logging. | Authorisation extract, log configuration |
| 13 | Completed changes are reviewed afterwards and metrics on success rate and emergency changes are evaluated. | ISO/IEC 27001:2022 Annex A 8.32 | Review the post-implementation reviews of failed changes and the metric reports of the last twelve months. | Post-implementation reviews, metric reports, action list |
Documents to request
- Process description for change management with catalogue of standard changes
- List of all changes of the last six to twelve months with category and status
- Change requests, approvals and test records of the sample
- List of emergency changes with retrospective approval
- Role matrix and authorisation extract for the productive environments
- System logs and deployment logs for the reconciliation
- Minutes of the change board
- Metric reports on changes
Typical findings
- Changes are requested after implementation; approval is dated after the change.
- Requests contain no rollback plan; for failed changes there is no evidence of recovery.
- Administrators change systems directly without a ticket; the reconciliation with system logs shows gaps.
- Requester and approver are the same person.
- Emergency changes make up a high share and are not approved retrospectively.
- Configuration management is not updated after changes.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing