CSD-RT RFP Recordkeeping_Administration Services Response 3-

285 / 499

This report is intended for use by the management of the Variable Annuity Life Insurance Company ("VALIC") and its subsidiaries.
VALIC Retirement Services Company ("VRSCO") and VALIC Financial Advisors, Inc. ("VFA"), its user entities, and the independent
auditors of its user entities, and is not intended and should not be used by anyone other than these specified parties. Click VALIC.com 78
General computer controls
Applications and Systems Development and Maintenance
Control Objective 12A- Controls provide reasonable assurance that changes to V-System are tested and approved
by VALICManagement.
Control Objective 12B - Controls provide reasonable assurance that changes to distributed systems including
SAP are tested and approved by VALICManagement.
VALIC Control Activities Tests of Operating Effectiveness Results of Tests
12.1 (12A, 12B) Mainframe and
distributed application program
changes are tested prior to
loading into the production
environment and testing
approvals are documented.
Mainframe
Inspected a sample of mainframe
application program changes to
determine whether they were
tested prior to migration into the
production environments and
approvals were documented in the
Change Management Notification and
Approvals (CMNA) system.
No exceptions noted.
Distributed Systems
Inspected a sample of distributed
systems application program
changes to determine whether they
were tested prior to migration into
the production environments and
approvals were documented in the
Change Management Notification and
Approvals (CMNA) system.
No exceptions noted.
12.2 (12A, 12B) Appropriate VALIC
user management must approve
all mainframe and distributed
application program changes
before being placed into
production.
Mainframe
Inspected a sample of mainframe
application program changes to
determine whether appropriate
business and technology approvals
from VALIC user management were
provided in the CMNA system before
the change was placed into production.
No exceptions noted.
Distributed Systems
Inspected a sample of distributed
systems application program changes
to determine whether appropriate
business and technology approvals
from VALIC user management were
provided in the CMNA system before
the change was placed into production.
No exceptions noted.
12.3 (12A) VALIC migration personnel
authorize program changes in
the electronic scheduler for
mainframe changes.
Inspected user access to mainframe to
determine whether developers did not
have access to migrate changes to the
production environment.
No exceptions noted.
IV. VALIC control objectives and controls, and PricewaterhouseCoopers LLP's tests of operating
effectiveness and results of tests