Lack of Change Control and Issue Tracking
Severity Level: Priority 3 Category: Governance / Compliance
Description: The bank lacks a formal change control and issue tracking process, closely tied to the absence of a ticketing system. This gap hinders the ability to track IT changes, monitor issues, and ensure compliance with FFIEC requirements for change management.
Impact:
- Increased risk of unauthorized or undocumented changes, leading to system instability.
- Non-compliance with FFIEC change management guidelines, risking audit findings.
- Difficulty in identifying and resolving recurring issues, impacting operational efficiency.
FFIEC Reference:
- FFIEC IT Examination Handbook, Management (June 2004):
- "Institutions should implement formal change management processes to control IT modifications." (p. 15)
- "Change control processes must include documentation and tracking of changes." (p. 17)
Recommendations:
- Implement a change control process integrated with the recommended ticketing system.
- Document all IT changes, including approvals, testing, and outcomes.
- Conduct regular audits of change logs to ensure compliance and identify potential risks.