Electronic Report Creation and modification --Change Control 1008

  • Hello all,
    I have a question about IT change control as it pertains to electronic reports and the creation/modification of custom reports.
    Say a company has an electronic financial and inventory management system. As part of that, they create custom electronic reports, etc. for management review (lets call it custom report1). A new manager comes in and decides that he/she would like to change custom report1 to add additional columns of data, or create custom report2.
    The question is this, can you exclude report building from the general change control policy of an organization. Custom reports are written all the time, and it seems like everyone is always tweaking them. Anyone have any thoughts on this?
    One thought was if it is operational in nature, then there is no need to run it through change control. If the report ties directly into the financial reporting process, then it needs to go through change control.
    BUT… what happens if a controller takes an operational inventory report, then starts making adjustments in the books up or down. The operational report has then turned into a financial report. Ideas welcomed and appreciated.

  • You need to identify which reports are related to a key control. They should always be put through change control.
    We went through this and suddenly found we had a two-tier process with some things being put through change controls and others not, and of course mistakes were made. So to eliminate those errors, and for general good housekeeping practices, all IT-written reports now go through change control
    But then, what about user-controlled reports? We have identified these and locked them down. We have also made sure that users are educated in which are the ‘key’ reports so we don’t end up with users re-generating new versions of them.

Log in to reply