Change Management Process Guidelines
General Guidelines
- Don't make changes during normal business hours (7:00am – 9:00pm M-F)
- The Change Maintenance window occurs the second weekend following the second Tuesday each month
- Change implementer must be present the day after a change is implemented
- Notify customers 1-2 weeks in advance for high-Risk changes
- Changes involving Emory Healthcare customers must be approved by the EHC change board
- Changes involving more than one team should be a minimum Risk Level 3
- Changes that can potentially disrupt all network connectivity should be a Risk Level 1
- All Changes can be viewed on the change calendar
Determining Risk Level
Use the charts below to help determine the risk level. The point system is a good way to determine the impact and urgency of the change. Once you have determined the points, use the prioritization chart as a guide for assigning the appropriate risk.
Change Management Risk Levels Questionnaire
| Question | 1 Point | 2 Points | 4 Points |
|---|---|---|---|
| Number of users Impacted | Single user, team or department | Multiple users, teams or department | All users |
| Criticality of service to business | If outage occurs, core business process can continue | If outage occurs, core business processes cannot be performed | Business critical; Change affects a major part of the business- critical infrastructure |
| Number of teams involved with implementation | Implementation activities are limited to a single IT group | Multiple teams in the same department within IT need to coordinate activities | Multiple team in different departments within IT need to coordinate activities |
| Can change be test? Can change be backed out? | Can be tested and backed out easily | Either cannot be tested or easily backed out | Cannot be tested nor easily backed out |
| Low (Risk Level 4 or 5) | Medium (Risk Level 2 or 3) | High (Risk Level 1 or 2) |
|---|---|---|
| < 7 | 7 - 11 | > 11 |
Change Management Approvals by Risk
| Risk | General Description | Lead Time | Approvals Needed |
|---|---|---|---|
| High | Change affects a major part of the business-critical infrastructure Change affects several applications or services; or a large number of users | 3+ weeks | Technical Approval; Change Manager Approval; CAB Approval; xCAB Approval |
| Medium | Change is related to a single application or service and side-effects can be safely excluded. If scheduled outside of the normal maintenance window, customer approval is required | 2+ weeks | Technical Approval; Change Manager Approval; CAB Approval |
| Low | Change has no or low impact to users in production. No downtime is required. | 1+ weeks | Technical Approval |
NOTE: Only Network Changes (using the network change models) require a Network Peer Review Approval prior to a CAB Approval. | |||
| Change Type | Change Description |
|---|---|
| Standard Change | Pre-approved, Low risk, frequently occurring (Not in use at this time) |
| Emergency Change | Resolves an outage, pending outage, or regulatory or security issue. Must be approved by the technical manager or Director either verbally, email or text. Must be associated to an Incident. |
| Expedited Change | Changes that are required within the normal lead time with a minimum lead time of 24 hours. These changes require approval from the technical manager, change manager and CAB. Risk Level 1 expedited changes require additional approval from the xCAB. |
| Normal Change | Changes submitted through the change process with appropriate lead time and approval. Risk Level 1 changes require xCAB approval. |
Handling of Risk Changes
The xCAB is required to make a decision on the expedited change within 24 hours after the Manager approval has been received, if Manager approval is between Sunday 5pm to Thursday 5pm, therefore these changes are required to be entered with at least 24 hours lead time
The xCAB is required to make a decision on the expedited change within 48 hours after the Manager approval has been received, if Manager approval is between Thursday 5:01pm to Sunday 4:59pm, therefore these changes are required to be entered with at least 48 hours lead time.
Handling of Expedited Changes
Medium Risk
The CAB is required to make a decision on the expedited change within 24 hours after the Manager approval has been received if Manager approval is between Sunday 5pm to Thursday 5pm, therefore these changes are required to be entered with at least 24 hours lead time
The CAB is required to make a decision on the expedited change within 48 hours after the Manager approval has been received if Manager approval is between Thursday 5:01pm to Sunday 4:59pm, therefore these changes are required to be entered with at least 48 hours lead time
expedited Change Approval Process:
- The submitter of the expedited change is required to engage the change manager to make them aware of the change and its urgency.
- The director of the implementation team must approve the expedited change before the CAB or xCAB can make a decision.
- If one CAB / xCAB member denies the change, the change is denied.
- In the case of no denials, half the total number of CAB / xCAB members must approve, otherwise the change will be denied.
Handling of Emergency Changes
Medium and Low Risk
Prior to implementing an emergency change, the manager of the resource implementing the change is required to approve the change.
Once the change record is documented in ServiceNow it is required to document the approval in the “Detailed Description” field in the following format: “Approved by Manager: ‘Manager X’”
High Risk
Prior to implementing an emergency change, the manager and director of the resource implementing the change is required to approve the change.
Once the change record is documented in ServiceNow it is required to document the approval in the “Detailed Description” field in the following format: “Approved by Manager: ‘Manager X’ and Approved by Director: ‘Director Y’”
Increasing Risk Level for Unsuccessful Changes
For "Failed" Changes or "Changes with Incidents", the subsequent change of the same type is required to increase at least one Risk Level (e.g. 5's will become 4's, 4's becomes 3's etc). The associated Risk Matrix will be required to be updated to reflect the new Risk Level. Once the change has been subsequently completed successfully 3 times, the risk level can be lowered back to the previous Risk Level and updated on the Risk Matrix.
Handling Changes that may Exceed the Planned Changed window
If an in-progress change exceeds the defined window, the change implementer has two options:
- Mark the change as failed, and utilize the backout plan defined in the change record
- Obtain authorization to extend the change window, with the following conditions
- If the Change is a. RL 4 or 5, obtain authorization from the Technical Manager who approved the change initially
- If the Change is a RL 2 and 3, obtain approval from the Service Owner and/or Director responsible for the change
- If the Change is a RL 1, the Director escalates to OIT leadership for approval and communicates the altered timeline immediately to OIT leadership, EHC Change leadership (as appropriate), and other business stakeholders
Unauthorized Changes
Verbal Warning
Change Users that perform an unauthorized change for the first time will receive a verbal warning from their supervisor informing them of the non-compliance to the process. The necessary coaching will take place in educating the user regarding to the appropriate steps necessary regarding changes in the future.
Written Warning
Change Users that perform unauthorized changes for the third time will receive a written warning from their supervisor informing them of the non-compliance to the process. The necessary coaching will take place in educating the user regarding to the appropriate steps necessary regarding changes in the future.