I am an IT auditor with a big 4 accounting firm and am cur the process of conducting an application program change audit for a large public company related to Sarbanes Oxley. This is my first time using this forum and need some assistance in verifying a fact that I believe to be true.

My client has a number of applications that are running on a UNIX platform, both AIX and Solaris, in which application changes are being programed and moved into production during the entire year under review. Part of our testing process is to obtain a listing of changes that were migrated into production affecting an application during the year under review. Typically, we begin our testing by obtaining a listing of modules and scripts that were migrated into production during the period under review from a program change migration tool. In this particualr instance, the client is using PVCS for version control associated with application changes, but does not have a program change migration tool in place; therefore, we have no way of obtaining a full population of application changes that were migrated into production during the period under review.

I am under the impression that a report can be obtained from the OS (UNIX) that is specific to a particular directory where the production region of an application resides that will show all modules or program changes that were migrated into that region that affected the application during the period under review. If this is the case, can anyone provide me with some guidance as to how I should request this from the client? Specifically, what report to obtain or what script can be run?

Try something like this: This will find files whose modification time is between the two timestamps. pstart is the last second before the period of interest, while pend is the last second of the period of interest. The sequence "! -name . -prune" will prevent the "find" command from desending into subdirectories to search for files. Remove that sequence if you want to search the entire directory heirarchy. The output from "find" will be stuiff like "./filename" but the sed statement removes that leading "./" for a nicer look.

Bear in mind that anyone can change the mod time of a file to anything by using the "touch" command just like this script does.