Jail Management System - Maricopa County

Issue 4 Change Management
Summary
MCSO does not have a formalized change management process for authorizing, testing, and
approving the Jail Management System (JMS) changes. JMS developers have unrestricted
access to the application. If unauthorized or untested changes are introduced into JMS, they
could create data integrity and system availability issues. MCSO should strengthen its change
management controls.
Criteria
COBIT recommends the following change management practices:
Condition
Ensuring applications are aligned with business requirements
Managing IT changes in a formal, documented, and controlled fashion
MCSO has not formalized its change management policy and procedures. Change management
procedures standardize the system change processes. Currently, the MCSO Technology Bureau
receives and coordinates requested changes via email with the agency requestor. Approvals are
handled informally and are not consistently documented before being moved into production
(where “live” transaction processing occurs). Developer access to the JMS production
environment is not appropriately restricted.
Effect
Formal change management procedures introduce system changes in a controlled and
coordinated manner and prevent unplanned, unauthorized, and untested changes to JMS.
Effective change management procedures also reduce the risk of service disruption and
associated costs.
Cause
MCSO Technology Bureau staff report that resource constraints have prevented them from
documenting change management procedures. Instead, they have relied on their extensive JMS
experience to compensate for this control weakness.
Recommendations
MCSO should:
A. Develop a formalized process for authorizing, testing, and approving JMS changes.
B. Limit developers’ access to JMS and/or implement system monitoring controls to identify
and review the appropriateness of system changes.
Maricopa County Internal Audit 12 Jail Management System–May 2012