Change Management

Simply put, change management exists to ensure there is a managed framework around the implementation of changes in an environment. An I.T. department that implements change without a change management program would be similar to going white water rafting without wearing a life preserver. You wear a life jacket so that if you fall in you don’t drown. In most company settings today, a change management program has to exist in some form to comply with various auditing. Without it, a company is operating at unnecessary risk, so requirements are put in place to ensure a company is doing everything possible to minimize risk to its customers and shareholders.

At its simplest, change management consists of the following steps:

  • An individual has something they need to implement, this could come from a ticket entered by a user or some other external influence like a requirement for a new project, etc.
  • The individual has previously stepped through a process to minimize risks. This might include applying a change in a non-production environment, one of which will not impact customers if something went wrong. After implementing in a test environment, a process is followed to verify it has no negative impact on the current system
  • A ticket is entered into a system describing the change needed to be performed and sent to an area where tickets are held for review
  • A Change Control Board comes together at a regular interval to review all tickets that have been sent in for a particular time period.
  • The indiviual that sent the ticket in for review attends the change control board meeting and verbally explains the ticket details along with implmentation date and associated plans such as a backout plan, in case the change does not execute successfully.
  • Any attendee of the change control board meeting has the opportunity to ask any questions related to a change.
  • If any conflicts or undocumented risks are identified those are discussed and resolved on the call.
  • If the consesus is to move forward with the change, the ticket is approved to be worked at the agreed upon time/date documented in the ticket.
  • The next ticket in the queue is reviewed and the same process happens with it along with every one after it, until all tickets in the bucket have been reviewed.
  • It is important for all attendees to stay engaged throughout the meeting until it is over, so they can help spot any potential conflicts with other tickets being reviewed.
  • At the documented time, the indivudal implements the approved change often notifying when the change is starting and when it is finished.
  • The results of the implmentation is documented in the ticket along with test results.
  • The ticket is closed

There are certainly more potential parts to a change management process, however, my attempt here is to start out by outlining it in simplest form. The alternative to the process above is would be an individual goes and tests out a change somewhere and once they feel ready to implement it into production, they use their sole discretion on when/how it gets implemented with little to no oversight from others. The biggest gap in this approach is the lack of communication opportunities with the rest of the company. Another big gap is without coming together in a bigger forum, no opportunity exists to make sure a change doesn’t conflict with any other change happening at the same time. The responsibility of a change control process is to consolidate and evaluate changes holistically, in order to minimize the risk of downtime due to lack of coordination with others.

In large organizations, a change control coordinator exists that has a full-time job of managing the change control board. When not coming together for regular change control meetings, they are often doing associated duties such as making sure required communications are going out into other parts of the business or interfacing with others to get external communications out to customers, if required. Change control meetings happen at all different intervals, depending on the size of the company and the volume of changes happening in the organization. I have personally worked in places where a change control meeting happened daily. In other places, the change meeting occurred once a week. Back way earlier in my career, I worked where a change control board didn’t exist at all (admittedly that was long before many of the auditing requirements were formed due to the need to protect customers).

To individual contributors, the change management process can seem more of a burden at times. However, it is important to come to an understanding of its true importance and why it is good for you. As opposed to seeing it as something you just have to endure in order to do your job. If your view is always the latter, it will prevent you from being as successful as you could be, with just a little more understanding of the benefits of embracing the process.

In a separate article, we will discuss a solid approach to implementing technical changes to ensure the highest possibility of success.

Leave a Reply