Requests, Risks, Approvals & Acceptance

What does change management (CM) refer to?

Policies and procedures that reduce the risk of configuration changes causing service downtime.

Change management is closely related to what?

Configuration management.

When is a change request generated?

When a fault needs to be fixed, new business needs or processes are identified, or there is room for improvement in an existing SOP or system.

How is the need to change often described?

Reactive (forced on the organization) or proactive (anticipated and initiated internally).

In a formal change-management process, what captures the need/reasons for change and the procedure for implementing it?

A request-for-change (RFC) form submitted for approval.

What should change-request documentation include about the purpose of the change?

The business case and benefits; might include analysis of risks of performing the change and risks incurred through not performing it.

What should change-request documentation include about the scope of the change?

Number of devices/users/customers affected; can include costs and timescales; for complex projects may include sub-tasks and stakeholders; includes factors to judge success or failure.

What should change-request documentation include about the type of change?

Whether it must be implemented quickly, is routine/standard, or is an emergency to correct a major outage; documenting priority/type can help expedite approval.

What are the categories of change type listed?

Standard (low impact, repeatable; can be repeated without triggering full CM process), Normal (one-time; triggers full CM process and requires change board approval), Emergency (high impact, urgent; expedited CM process and approval).

What should change-request documentation include about the implementation schedule?

When it will be incorporated (specific date/time), whether during a normal maintenance window, and whether there is a change freeze (temporary stop on making changes).

What should change-request documentation include about the effects of the change?

What systems are directly or indirectly affected and any risks involved in implementation.

What other considerations may be required when making a change suggestion?

Adequate testing in a sandbox or non-production testing environment; document the responsible employee who will implement the change and others responsible for the affected system or service.

What should each change being requested undergo?

A risk analysis.

What is risk analysis?

A systematic approach to identify possible risks associated with implementing the change.

What critical-system question might risk analysis ask?

Could the change cause a temporary outage of a critical system or service?

What employee-safety question might risk analysis ask?

Is there a risk of injury or death to the employee?

How can risks differ between changes?

Some changes will have minimal risks; others may include high-level, severe risks.

For each risk identified, what should be determined?

What controls or checks can be used to mitigate the risk to an acceptable level.

What safety procedures might help reduce or eliminate risk during implementation?

Securing power to the equipment or having a safety observer present during the implementation process.

Why is understanding cause and effect important in change management?

Understanding the cause and effect of changes can be just as important as the change itself.

After a change request has been drafted and submitted, what must it go through?

An approval process.

If a change is normal or minor, who might grant approval?

A supervisor or department manager.

How are major changes more likely to be managed, and what approval do they require?

Managed as a dedicated project and require approval through a Change Advisory Board (CAB).

What is the role of the CAB?

To assess both the business case and the technical merits and risks of the change plan.

Who should the CAB include?

Stakeholders for departments/users/customers impacted by the change; those proposing it; technicians responsible for implementing it; managers/directors who can authorize the budget.

What is implementation in change management?

When we have the approval to make a change and we have the authority to make the change.

Why might implementation require multiple steps?

To be followed to accomplish the change task.

After the change is completed, what may be necessary to confirm it was done correctly?

A colleague conducts a peer review that the change was implemented correctly in accordance with the approval.

Why is peer review useful after a change?

Technicians may skip a step or misspell something; peer review catches mistakes before bringing the system or service back online.

If the change process runs into an issue, what may be required?

A rollback plan to reverse the change and restore the system to the original configuration.

What should be part of the rollback plan?

A backup plan.

What is the backup plan in this context?

A system and data backup used to restore the system should an error in the change process occur.

What else might be required besides restoring from backup?

Switching to a complete replacement system; shifting services to alternative sites.

After the change is complete, what may be necessary from users?

End-user acceptance that the change has been implemented and the system is fully functional.

What does end-user acceptance ensure?

The customer or client is satisfied with the change and there are no further issues caused by the change.

What might some organizations require after end-user acceptance?

A signature from the customer or client after they have accepted the change and its successful implementation.

What is the last step of any change control process (per reference)?

End-user acceptance (sign-off from the end users associated with the change).