According to a 2005 Gartner report[i], “IT change management is a formalized process with documented procedures and work flows…. The goal is to enable controlled changes while preserving the integrity and service quality of the production environment.”  An important part of this process is the Change Advisory Board (CAB), whose charter is to review requests for change and ultimately, either approve or reject such requests for change.  Let’s examine the top 10 reasons why a CAB might reject a change request.

1. REQUIRED APPROVALS NOT ATTACHED

Any IT change control process worth its salt will require approval for a change from someone other than the change submitter.  Typically, each major subsystem, or even application, is assigned an “owner,” who is responsible for approving every change to the subsystem or application.  This type of structured procedure keeps the chain of responsibility intact and prevents unannounced or unauthorized changes from disrupting a production environment.

2. NO BACK-OUT PLAN INCLUDED

Another basic part of any sensible change control process is the inclusion of a back-out or fallback plan.  With any proposed change to a controlled IT environment, there is always a chance that some unforeseen circumstance may prevent the successful implementation of the change, whether it be large or small.  A clear statement of how to return the environment to its original, pre-change state is a critical component of every well-planned change.

3. REQUEST SUBMITTED PAST STATED DEADLINE

In any operative enterprise or organization, IT change management is a continuous process that evolves with the needs of the company.  In order to manage change effectively and smoothly, everyone must comply with his or her deadlines so that other people responsible for other steps of this continuous process have a reasonable amount of time to properly perform their function. 

For example: at Company A, software changes are managed on a weekly basis; therefore, a reasonable deadline would be that all changes scheduled for next Monday be submitted by Friday at noon, so that they can be reviewed at the weekly Friday 2:00 p.m. Change Meeting.

If some such logical schedule is not followed, chaos is sure to ensue.

4. EVIDENCE OF SUCCESSFUL TESTING NOT INCLUDED

Another vital requirement of a well-managed change system is that all change requests must include associated and relevant testing evidence.  Change to a controlled environment should not ever be made “on faith.”  There are, of course, situations where the exact actions that will occur in the controlled environment cannot be performed in the test environment (like sending money to a client), but all changes should be simulated to the utmost degree possible to reduce the likelihood of errors in the controlled system.  Change requests with no testing evidence attached should be rejected by the CAB – except where special and well-understood circumstances apply.

5. IMPLEMENTATION INSTRUCTIONS MISSING OR INCOMPLETE

To standardize and further automate your change process, you will need a plan that describes what the change action is.  Some companies refer to this plan as an implementation plan.  Regardless of what you call it at your company, you will need this plan.  As your organization changes over time, the implementation plan should evolve with such changes.  Moreover, it also has to capture all the standard change actions that have occurred company-wide.  It is the responsibility of the change requester to add the required information to the plan.  It is the responsibility of the CAB to assure that the plan is valid before anyone tries to act on the instruction it contains.  In sum, it makes perfect sense that an incomplete implementation plan will cause a change request to be rejected.

6. REQUESTED IMPLEMENTATION DATE IS IN A FREEZE PERIOD

Most organizations will block off certain days every month when any normal changes to the controlled environment are disallowed.  For instance, the change blackout period might be the end of each month when the company is closing out its financial records for the month.  During such a period, only emergency changes are permitted, and any such emergency change usually requires a high-level approval in order to move forward. 

The requirement of high-level approval accomplishes 2 objectives: 
1) Assures that senior managers are aware of the change
2) Discourages the misuse of the emergency change method by those who somehow did not complete a process on time.

7. REQUESTED CHANGE COLLIDES WITH ANOTHER SCHEDULED CHANGE

Another important function of the CAB is to prevent colliding change requests from being teed up at the same time. 

Example: The owners of System A are not fully aware of the plans and activities of System B.

Over time, the CAB should become sufficiently aware in all of the company’s systems that it can help prevent changes in one system that would negatively affect another. 

Example: System A produces output that is used by one or more other systems in the company.

Therefore, a planned change in System A might cause a problem in some downstream system that the owners of System A might not have considered.  The CAB can reject a change request when it detects such a situation.

8. REQUIRED CAVEATS/LANGUAGE NOT INCLUDED IN APPROVAL

A particular company may require that certain statements are included in every change approval form.  A federally regulated company may require, for example, that the Sarbanes-Oxley compliant controls be included in all change approval forms.  The lack of adhering to such controls would be a valid reason for rejecting a change request.

9. PROPER REQUEST ROUTING INFORMATION NOT SPECIFIED

A well-designed IT change request will include instructions that tell an analyst what group the change request should be sent to—that is, who will actually do the work described on the change form.  Without such information, the change request cannot be processed and should be returned to the requester.

10. CAB DECIDES THAT A REQUEST IS NOT COST-EFFECTIVE

The CAB can operate at a number of different levels.  In addition to processing the daily requests for change to existing processes, the CAB can also evaluate the cost-effectiveness of large, capital-intensive changes.  Some companies reserve such reviews for changes with an estimated cost over “X” dollars.  If the CAB decides that the proposal is not cost-effective, the project would be stopped.

The 10 issues described above are just some basic characteristics of a well-designed change process.  To delve deeper into ITIL-based change management, try the change management section at  IT Library .

---

[i] Gartner, Inc., Optimize Change and Configuration Management With People, Processes and Tools by Ronni Colville, Patricia Adams, Kris Brittain, August 3, 2005.

Share on Facebook

If there’s one thing that’s true in IT, as in all business, it’s that change is unavoidable. It’s how you deal with that change that will make or break your business.

One of the keys to managing change is creating a Change Advisory Board, or CAB, which will help a business balance the need for the changes with any inherent risks. The members of this board will give the change management team the input necessary to help you make the best decisions for your company.

The job of the CAB is to review and prioritize any potential changes, keep track of the change process, and provide feedback. The board will also make sure that all the stakeholders including IT, security and business analyze the changes. The board will help ensure that the changes are implemented without disrupting your customers’ operations.

But once the CAB is established, what can be done to ensure that the board’s meetings are as productive as possible?

For one thing, the Change Manager, who convenes the meeting, must make sure that someone from the essential departments in the company are at the meeting. The Change Manager, who is responsible for change management, serves as the leader and facilitator of the CAB. If board member disagree about how best to prioritize changes, the Change Manager can resolve those disputes.

The CAB must meet on a regular, published schedule, typically weekly, to authorize changes. Hold meetings at a time that is convenient for board members. But they should be held at the same time and same day every week for consistency’s sake.

No one in the company should schedule a meeting that conflicts with the CAB meeting. And, if at all possible, CAB meetings should not be cancelled. Decide whether every board member needs to attend every meeting. Members new to the board should receive an orientation before they begin. The orientation should include the board’s bylaws, work plans, and descriptions of their roles on the board.

In order to make the meeting run smoothly, the topics for discussion should be distributed to each member of the board before the meeting. Too much time will be wasted if the members are required to review this information for the first time at the meeting.

These topics include:

• The requests for changes that have been submitted

• Minutes of the last meeting to be reviewed

• Updates of the status of changes that the board has already approved

• Review of the changes that have already been completed

Taking part in a Change Advisory Board requires members to listen to the ideas and opinions of other members. And they should discuss those ideas and opinions before making any final decisions. Sometimes it’s hard to work together as a group but here are a few tips to help board members feel more comfortable with one another and become a cohesive board:

• Ensure board members know each other’s names and a little bit about each other

• Encourage all board members to participate in the discussions and brainstorming sessions

• Ensure that each board member respects the opinions of fellow board members

In order to keep the CAB meeting moving forward as efficiently as possible, the Change Manager has to take charge and own the meeting. He must let members know he plans to keep the discussion on topic and on time. Having a clock nearby lets members know he values their time. Keeping to the schedule of agenda topics, and setting a time limit for each agenda item, will also help the Change Manager keep the meeting on track. If the members start to discuss something that’s not on the agenda, the leader must refocus their attention to the task at hand.

For the meeting to be most productive, the Change Manager has to be sure to get input from all the board members. He should treat all board members with respect and not immediately reject ideas or opinions he believes are worthless. And he must not impose his opinion on the group.

Before the meeting ends, the Change Manager should ensure that all the board members understand the next step or steps. Additionally, he should ask members if they thought the meeting was useful and stayed on track and what could be done differently at the next meeting. He could also follow up with board members individually to gain insight into his meeting strategies.

Finally, the Change Manager should ensure that the appropriate people understand what happened at the CAB meeting and what decisions were made. In addition, the Change Manager should have a system in place to track the board’s decisions and what, if any, tasks individual members agreed to undertake so he can follow up with them to make sure things are proceeded as scheduled.

Share on Facebook