1. State Government Finance and Policy and Elections Committee Briefing January 23, 2018
James Nobles| Legislative Auditor
Christopher Buse | Deputy Legislative Auditor

2. Why IT Change Management?
Dependence
Nearly All Critical Government Services Rely on Information Technology
Complexity
IT Systems Have A Wide Array of Interconnected Hardware and Software Components
Fragility
Changes to Any Interconnected Components Can Lead to System Failures

3. The Discipline Criteria Vendors Compliance
Generally Accepted Best Practice Criteria Exist
Vendors
Vendor Products Help Organizations Implement IT Change Management Best Practices
Compliance
IT Change Management Requirements Embedded in Regulatory Frameworks

4. IT Change Management Process
Change Request
Planning
Approval
Implementation
Closure
IT Change Management Process
What
Why
Risks
Detailed Plan
Testing
Back-out Process
Risk Analysis
Change Advisory Board
Assess Success
Initiate Back-out
Document Results
Goal: Avoid Change-related Disruptions to Services

5. Conclusion Generally adequate controls over IT change management
Enterprise policies and standards
Policies and standards are being followed
Several systemic issues
Inadequate
Adequate

6. Finding 1 Disparate change management software products and processes
Make it difficult to diagnose problems
Increase the likelihood of change-related failures
OLA recommends more closely integrating disparate change management processes and software products

7. Finding 2 MNIT lacks key controls to detect unauthorized changes
Few automated processes to detect unauthorized changes
Inability to monitor compliance with security and regulatory baselines
OLA Recommends that MNIT deploy specialized software to improve its ability to detect unauthorized changes

8. Questions?