245 / 499
This report is intended for use by the management of the Variable Annuity Life Insurance Company ("VALIC") and its subsidiaries.
VALIC Retirement Services Company ("VRSCO") and VALIC Financial Advisors, Inc. ("VFA"), its user entities, and the independent
auditors of its user entities, and is not intended and should not be used by anyone other than these specified parties.
Back to TOCClick
VALIC
.com 38
General computer controls
Note: Parenthetical references are included in the narrative as a cross-reference to the applicable control
procedures included in Section IV of this report.
Applications and Systems Development and Maintenance
Mainframe Application – Change Management
VALIC Information Technology andMphasis application support team provides computer-programming support
for the V-System application to support plan administration. As noted above, certain IT functions for V-System
are supported by CTO, a subsidiary of AIG. Programs and other components of mainframe applications reside
in mainframe protected datasets or libraries. There are development libraries, quality assurance testing libraries,
production stage and production libraries. There is also a separate set of libraries used for emergency moves.
Programmers can only modify items in the development libraries.
Production libraries, quality assurance (QA) testing libraries, and production stage libraries can be viewed but not
directly edited. They are updated only by the change management procedures, which are production batch jobs.
The change management jobs move changed programs and other components of mainframe applications from
the development libraries through quality assurance testing libraries to the production libraries. Access to load
program changes into the production environment is restricted to an electronic scheduler for mainframe moves.
Access to migrate changes to the production environment is limited to authorized VALICmigration personnel
separate from development function
(12.4)
. VALICmigration personnel authorize program changes in the
electronic scheduler for mainframe changes
(12.3)
. PanAPT, a change control product fromComputer Associates
International, Inc., is used to control the libraries and the movement of components between them. The PanAPT
library levels are development, systems test, stage test, production stage, and production. PanAPT is maintained
by CTO, a subsidiary of AIG.
Mainframe Application — Standard Change Management Process
The mainframe programmer checks out the programs that he/she needs to modify. This process copies the
programs from the production to the development library for maintenance. The checkout is accomplished by
creating a move request with the appropriate line items in PanAPT. Access to migrate changes to the production
environment is limited to authorized VALICmigration personnel separate from development function
(13.1)
.
The programmer completes the code modifications in the development environment. Upon completion of unit
testing, the programmer verifies and closes the move request within PanAPT. The verification process requires that
any concurrent development issues be resolved. The programmer then requests, via the Change Management
Notification and Approvals (CMNA) system, that the application manager approve the request to move the
program to a QA environment.
After the application manager has approved the move to QAwithin CMNA, a QA coordinator approves the move
within the PanAPT system and CMNA. Approval of the move request within PanAPT releases move request to
the next level. The PanAPT change management jobs are scheduled to run several times per day. When running,
the jobs scan for move requests that have been approved. If the move request has been approved to move to the
next level, then the request is moved accordingly in this case, to the QA or system test environment. The PanAPT
change management jobs can also be requested to be executed adhoc via change requests.
III. Description of the VALIC Defined Contribution Plan Administration System