Change Process Guidelines
General Guidelines
- Do not make changes during normal business hours (7:00am – 9:00pm M-F)
- Change implementer must be present the day after a change is implemented
- Notify customers 1-2 weeks in advance for high Risk changes
- Changes involving Emory Healthcare customers must be communicated to the users 2 weeks prior to implementation
Risk Level Guidelines
| Risk Level | General Description | Lead Time | Approvals Needed |
|---|---|---|---|
| 5 | Standard Change | n/a | Technical Manager |
| 4 | Standard Change requiring additional visibility | 1+ week | Technical Manager |
| 3 | Change is related to a single application or service and side-effects can be safely excluded | 2+ weeks | Technical Manager; Change Manager; CAB |
| 2 | Change affects several applications or services; or a large number of users *Requires Walk-through with CAB | 3+ weeks | Technical Manager; Change Manager; CAB |
| 1 | Change affects a major part of the business-critical infrastructure *Requires Walk-through with CAB & xCAB | 3+ weeks | Technical Manager; Change Manager; CAB; xCAB |
Increasing Risk Level for Unsuccessful Changes
For "Failed" Changes or "Changes with Incidents", the subsequent change of the same type is required to increase at least one Risk Level (e.g. 5's will become 4's, 4's becomes 3's etc).
The associated Risk Matrix will be required to be updated to reflect the new Risk Level. Once the change has been subsequently completed successfully 3 times, the risk level can be lowered back to the previous Risk Level and updated on the Risk Matrix.
Maintenance Notice Email Template
This communication is required for Risk Levels 1’s, 2’s and 3’s. For Risk Level 4’s and 5’s use the guidelines below as you find appropriate for your change.
Audience
- For widespread impacting Changes: MAINTENANCE-NOTICE@LISTSERV.CC.EMORY.EDU
- All Service Owners associated with the Services Impacted within the change record
- University Service Desk: UTS-SERVICEDESK@LISTSERV.CC.EMORY.EDU
- Healthcare Helpdesk (if Healthcare is impacted): is.service.desk@emoryhealthcare.org
- NOC, if alerts will be impacted
Content
Email Subject: Maintenance Notice: “Service/Application impacted” – “Change Number” – “Short Description”
Email Body:- Change Number: ”Change Number”
- Summary of the Change: Enter a description that will be easy for other people to use to reference this particular change. This should be the “Short Description” and “Detailed Description” fields from the change record
- Reason for the Change: “Reason for Change”
- Description of Impact:
- End User Impact: What the person using the service might experience during the change
- Technical Impact: Any additional information useful for IT staff (and potentially their service/s) impacted as a result of this change
- Schedule of Change: From “Planned start date” to “Planned end date”
- Downtime: ”Downtime”
- Workarounds: Include if there are workarounds for end users during this change
- View Change Calendar
Handling of Urgent Changes
Risk Level 2 and 3
The CAB is required to make a decision on the urgent change within 24 hours after the Manager approval has been received if Manager approval is between Sunday 5pm to Thursday 5pm, therefore these changes are required to be entered with at least 24 hours lead time
The CAB is required to make a decision on the urgent change within 48 hours after the Manager approval has been received if Manager approval is between Thursday 5:01pm to Sunday 4:59pm, therefore these changes are required to be entered with at least 48 hours lead time
Change Management Approval policy:
- The submitter of the urgent change is required to engage the change manager to make them aware of the change and its urgency
- The director of the implementation team needs to approve the urgent change before the CAB can make a decision
- If one CAB member denies the change, the Change is denied
- In the case of no denies, half the number of the total members of the CAB need to approve, without that the change will be denied
Risk Level 1
The xCAB is required to make a decision on the urgent change within 24 hours after the Manager approval has been received, if Manager approval is between Sunday 5pm to Thursday 5pm, therefore these changes are required to be entered with at least 24 hours lead time
The xCAB is required to make a decision on the urgent change within 48 hours after the Manager approval has been received, if Manager approval is between Thursday 5:01pm to Sunday 4:59pm, therefore these changes are required to be entered with at least 48 hours lead time
Change Management Approval policy:
- The submitter of the urgent change is required to engage the change manager to make them aware of the change and its urgency
- The director of the implementation team needs to approve the urgent change before the xCAB can make a decision and then is not included in the following criteria
- If one xCAB member denies the change, the Change is denied
- In the case of no denials, half the number of the total members of the xCAB need to approve, without that the change will be denied
Handling of Emergency Changes
Risk Level 2, 3, 4 and 5
Prior to implementing an emergency change, the manager of the resource implementing the change is required to approve the change.
Once the change record is documented in ServiceNow it is required to document the approval in the “Detailed Description” field in the following format: “Approved by Manager: ‘Manager X’”
Risk Level 1
Prior to implementing an emergency change, the manager and director of the resource implementing the change is required to approve the change.
Once the change record is documented in ServiceNow it is required to document the approval in the “Detailed Description” field in the following format: “Approved by Manager: ‘Manager X’ and Approved by Director: ‘Director Y’”
Unauthorized Changes
Verbal Warning: Change Users that perform an unauthorized change for the first time will receive a verbal warning from their supervisor informing them of the non-compliance to the process. The necessary coaching will take place in educating the user regarding to the appropriate steps necessary regarding changes in the future.
Written Warning: Change Users that perform unauthorized changes for the third time will receive a written warning from their supervisor informing them of the non-compliance to the process. The necessary coaching will take place in educating the user regarding to the appropriate steps necessary regarding changes in the future.