This could result in delays in production processing, hence, customer dissatisfaction. All changes have documentation stating that they have been received and reviewed by a QA type function and approved by the User prior to installation into production. Documentation exists showing a source comparison was performed prior to installation into production. A source comparison will determine if the current production source matches the current load program. Obtain a copy of the change reconciliation report.
Verify evidence exists for the review and reconciliation of changes.
Lack of an emergency change process could result in the unauthorized migration of code into production. This may result in delays in production processing, hence, customer dissatisfaction. Determine if a process exists to control and supervise emergency changes. Determine the use of emergency user ids. Id usage and that it is independently reviewed.