https://community.isc2.org/t5/Governance-Risk-Compliance/System-generated-listing-of-changes-from-Production-Servers-for/m-p/52841#M726 <P><SPAN>Hello:</SPAN><BR /><SPAN>SOX asks companies to obtain a system generated listing of changes from the production environment and then map back to tickets...Simple concept but hard to do for all environments....</SPAN><BR /><BR /><SPAN>How are companies subject to SOX complying with this request? We provide last modified date but that is no longer enough for our audit firm so we are trying to think of ways to comply&nbsp;</SPAN></P> Tue, 30 Aug 2022 22:34:24 GMT Midude2000 2022-08-30T22:34:24Z https://community.isc2.org/t5/Governance-Risk-Compliance/System-generated-listing-of-changes-from-Production-Servers-for/m-p/52841#M726 <P><SPAN>Hello:</SPAN><BR /><SPAN>SOX asks companies to obtain a system generated listing of changes from the production environment and then map back to tickets...Simple concept but hard to do for all environments....</SPAN><BR /><BR /><SPAN>How are companies subject to SOX complying with this request? We provide last modified date but that is no longer enough for our audit firm so we are trying to think of ways to comply&nbsp;</SPAN></P> Tue, 30 Aug 2022 22:34:24 GMT https://community.isc2.org/t5/Governance-Risk-Compliance/System-generated-listing-of-changes-from-Production-Servers-for/m-p/52841#M726 Midude2000 2022-08-30T22:34:24Z https://community.isc2.org/t5/Governance-Risk-Compliance/System-generated-listing-of-changes-from-Production-Servers-for/m-p/52842#M727 <P>We went through a number of years ago and had to change the way that we worked.</P><P>&nbsp;</P><P>We had to "mandate" that all developers used our trouble ticket system to "input changes" that were being planned.&nbsp; This allowed us to show audit that the change was planned, coupled with the change mgmt reports showed that the changes were also approved.</P><P>&nbsp;</P><P>We did this for all systems not just those under SOX testing (control).</P><P>&nbsp;</P><P>Of course this assumes that you have a Trouble ticket system.&nbsp; At a minimum, you might be able to use the minutes from your change management meetings (again, hopefully you have these).</P><P>&nbsp;</P><P>Anyone else?</P><P>&nbsp;</P><P>d</P><P>&nbsp;</P> Tue, 30 Aug 2022 23:30:00 GMT https://community.isc2.org/t5/Governance-Risk-Compliance/System-generated-listing-of-changes-from-Production-Servers-for/m-p/52842#M727 dcontesti 2022-08-30T23:30:00Z