Procedure Guidelines and Controls Documentation December 11, 2005 © Robin Basham, M.Ed., M.IT, CISA, ITSM, CGEIT, CRISC, ACC

Want to implement your own Process Program? Contact EnterpriseGRC Solutions, Inc.. Try our FREE PROCESS ASSET LIBRARY

EnterpriseGRC Solutions, Inc. is proud to be listed with and to support Jim Kaplan's AuditNet.org

Portions of this page are published in the ISACA Control Journal.  Copyright © 2006 ISACA. All rights reserved.

For a live view of the article as published, please visit ISACA Control Journal

TEMPLATE [Company Name]

Sample Document for use as model for corporate process guidelines and procedures Content is protected by Copyright, ALL RIGHTS RESERVED

Version Control

[This is a prototype for the benefit of persons seeking a model for an overall compliance program.]

Purpose and Scope

Procedure Guidelines and Controls Documentation outlines how to create and modify procedures, work instructions, policies, and RunBooks as they currently exist in their correct location and format and as aligned to the requirements of document security.

Change control, information asset location, and documentation format standards are the combined responsibility of Security Management, Quality Assurance, and Process Engineering.  In the context of creation, iteration, approval, and posting, the Process Librarian manages documentation.

Process Engineering manages quality over documentation as demonstrated by document templates.

Security Management defines policy and access rules for the recording, adherence to, and monitoring of procedures involving data integrity, privacy, and security across any enterprise-level configuration.

Policy Statement

All changes, additions, and deletions to the production documentation library require management approval.  Managers should notify Process Engineering of changes to production process.

Requirements

The primary security elements of any document library management process are:

• Auditable changes
• Evidence of document library and document lifecycle management that is readily available for those who need to monitor this activity.

Documentation strategies need to:

• Reduce complexity.
• Prioritize key control processes
• Reflect  COMPANY process architecture
• Represent real functions and real activities

Prev - Next >>

< Prev