What is Preventive Controls

Situations such as improvements in business transaction processing and various security issues keep today's information systems in a constant state of change. Serious disruption of company operations can occur when changes are improperly planned and/or carried out. In addition to technological issues, an equally important consideration is in regard to how information system changes will affect organizational personnel. The Institute of Internal Auditors has identified seven steps that can be used to effectively implement change in an information system environment. This along with a discussion of significant issues in managing system patches provides an appropriate background to consider a model for evaluating the maturity of an organization's change management process in an information system environment. The highly respected COBIT guidance from the ISACA is included throughout much of the discussion to provide support for many of the suggested change management practices.