Managing change is one of the most difficult challenges that IT organizations face, and to effectively support and facilitate enterprise business goals, IT must also continually change. Change must be controlled to mitigate the inherent risk to IT’s compliance, service quality, and security posture.
Business survival often depends on adaptability to the pervasive and rapidly changing nature of technology. Improperly managed changes by IT staff are responsible for majority of system outagees. Hence, IT & Audit staff require greater visibility and responsibility in the up-stream and down-stream dependencies of business.
The productive adaptation of Information Technology can be achieved via collaboration of the following initial three concerns;
- Change Policies and Procedures – with process identification for emergency and normal changes.
- Internal control process for accountability and compliance.
- Responsibility and Reward process for change productivity
What is Change Management – as defined by ITIL, as follows;
-
Change Management would typically be composed of the raising and recording of changes, assessing the impact, cost, benefit and risk of proposed changes, developing business justification and obtaining approval, managing and coordinating change implementation, monitoring and reporting on implementation, reviewing and closing change requests.
The following diagram depicts how change management can be viewed as part of the service delivery process – ITIL NetworkD. We think Problem and Incident Management do not always result in changes to IT resource, therefore have included them as part of Other ITBP, together with Backup & Recovery process – see ITBP-Other_ITGC. In addition, Release and Configuration management would be part of the Change Management process. Our view is that Change Management is central to service delivery and support.
It is important that the change management process recognizes the difference between a user and/or an application change; to ensure the following:
- Service Availability: Analysis and Recovery from system failure.
-
Sarbanes-Oxley Compliance: Accountability, e.g. changes made by Database Administrators.
The goal of the Change Management process is to ensure that standardized methods and procedures are used for efficient and prompt handling of all changes, in order to minimize the impact of change-related incidents upon service quality, and consequently improve the day-to-day operations of the organization – ITIL.