The Robert Mondavi Corp. is using TeamTrack process and issue management software from Serena Software Inc. to help support regulatory compliance, based on the advice of auditors who saw the tool being used to track and prioritize application change requests, says Brian Shelden, director of IT at the Oakville, Calif.-based winemaker.

Mondavi has also begun using TeamTrack to track changes made to applications, from the request for a change all the way to production, Shelden says. For example, the tools are used to document when changes are made in response to calls to a help desk or to track product price variations from state to state, he adds.

"[Sarbanes-Oxley] requires us to document where the request was coming from, who requested change, what review process that went through, who was involved in approving those changes and what changes where made to ERP applications," Shelden says. "TeamTrack allowed us to have an audit trail of that process."

John Hagerty, an analyst at AMR Research Inc. in Boston, says most companies working to comply with Sarbanes-Oxley have yet to use software to document application development processes. Most, he says, are still using manual processes for change management because they have not seen tangible advantages in using IT for compliance.

Making changes to applications "can change or invalidate the controls that have been put in place to run the business," Hagerty says. "Or, companies will make a change and forget to change the documentation when they should be making the changes to the written documentation and then making changes to the system."