In this work program sample, we provide general best-practice steps for the configuration controls audit process.

Sample steps include: identify key contacts for audit areas; obtain and review the policies and procedures for configuration management activities; review any known best practices for configuration controls and incorporate them into the audit work and audit report; obtain organizational policies and procedures related to the acquisition, inventory and disposition of purchased, rented and leased computer-related equipment and software; and obtain IT policies and procedures related specifically to the acquisition, disposition and maintenance of configuration resources.