Configuration Management Audit Checklist
Date of Audit: (Date of execution of audit.)
Release Identification: (Release prefix and release number with title.)
Questions: The number and content of checklist questions should be designed to ensure all procedures in a specific task within the AIS are performed as documented. Questions should be posed to require a “yes/no” response. “Yes/no questions should be presented so that all “yes” answers indicate successful completion of a task and “no” a lack thereof.
Checklist for Configuration Management (CM):
- Whether a Configuration Management plan is prepared for the project?
- Are the procedures defined in the CM plan followed by the software project team?
- Whether a Configuration Identification procedure exists for all work products? Is the Procedure in use?
- Has a repository or library been established to store all configuration items?
- Have baselines been established according to the plan/procedure?
- Has a change control authority been defined?
- Does a written change control procedure exist? Do all project teams follow it?
- Are “check in” and “check out” procedures used for all CI’s.?
- Is every change request accompanied by documentation?
- Are change reports generated for all change requests that are approved?
- Have the appropriate change control steps been followed (informal vs. formal) to document, approve, track, and manage changes to CIs?
- ? Do all project teams follow it?
- Can an existing CI be retrieved in less than 5 minutes? Can the version of the CI(x) be identified immediately? Is it possible to identify all related CIs in less than 5 minutes?
- Is a change log maintained?
- Are changes reported to those with a need to know (is problem escalation process followed)?
- Are formal reviews conducted prior to the release of a changed CI?
- Are changes to the project baseline tracked/available for review?
- Are all changes traceable to a documented request for change (e.g., a CR/MR/IR form or a walkthrough report)?
- Are versions of the project baseline available at the standard milestones defined for the project (e.g., end of each stage, prior to each walkthrough review of a product, etc.)?