Our change management procedure was created out of audit concerns. We wanted to ensure that changes to productions were properly approved and documented. Many Universities adopt change management for the same reason--to satisfy audit requirements.

Audit is a core component of process improvement: audit tells an organization whether it's really doing what it says it's doing. Audit can also be "the stick" by which process improvement is justified. More than that, however, IT can learn what to improve most from the questions auditors ask.

The IT Process Institute and the Institute of Internal Auditors teamed up to write an article, Leveraging IT Controls to Improve IT Operating Peformance. This article suggests three controls that identify high performing IT organizations: