Diagnosing audit results
When an audit shows discrepancies between actual and authorized CIs, you must determine the cause of the differences in order to choose a plan for remediating them. Three views in the CI Reconciliation Results application can assist you with this determination.
Authorized configuration items can come to differ from the corresponding actual CIs in a variety
of ways:
- An unauthorized change might be made to the actual CI.
- A change request might be approved and the authorized CI updated before the actual CI is modified.
- A change, such as an upgrade to a newer software version, might have failed, but the authorized CI was updated.
- An entry error might have been made in updating an authorized CI.
- There are numerous other ways in which discrepancies can arise.
To determine the cause of the discrepancy, you can use these views:
- Related change work orders
- This section lists all the change management work orders that affect this CI. You can view the details for each work order. These work orders represent authorized changes that have been, or should be, made to the CI. If the change has been carried out, but the authorized CI has not been updated, you can update the authorized CI to match the actual CI. If there is no work order associated with this CI, the change might have been unauthorized.
- CI attribute history
- This section lists the full change history for the CI attribute in this record, including the name and value of the attribute, the date of the change, and who made the change. Each row in the table represents one change to this attribute value. You can compare this data with change work orders to determine why the change was made and whether it was authorized.
- Last reconciliation result
- This section lists the most recent reconciliation (audit) result found for the same attribute of
this CI. This helps you to determine when the discrepancy occurred. For example, if the last
reconciliation result shows that the actual and authorized CI attribute values matched, you know
that the discrepancy arose after that result was generated. If the previous result showed the same
discrepancy that appears now, you know that it is not a new problem.
Note that if two consecutive reconciliation results are the same, no new record is made of the reconciliation results, but the date on which they were generated is updated. If the Created Date and Changed Date fields contain different values, the same result was found on both those dates.