Change Management

Chris Colomb
Trish Fullmer
Jordan Bloodworth
Veronica Beichner
 Definition of Change Management

Process of planning, organizing,

coordinating and controlling the
compositions of the environment, internal
and external; to ensure that the process
changes are implemented according to
approved plans and the overall objectives
of introducing the changes are achieved
with as little disruption as possible.

Oseni, Ezekiel, 10/26/08, “Change Management in Process Change,” 2007, Journal Online.
Process Changes
Responsibility of top management
Not only have to manage their employees
but their whole environment that’s
affected:
 Suppliers
Customers
Competitors
Can be very draining on finances and
people involved
Steps for change:
1) Pre-implementation
 Realize the need for change

 Determine cost/benefit of new change

 Management must support the new change and

display this support to others
• 3 ways to deal with resistance to change
 Ignore it
 End it by preventing it
 Implement crisis management
Steps for change:
2) Implementation
 Many companies fail before they make it here
 Elect a standing committee
• Composed of all departments affected
• Meet on a regular basis
• Meet when problems arise in order to find solutions

 Should appreciate all stakeholders for their

patience and understanding
Steps for change:
3) Post-implementation
 Make sure project achieved planned results
 Problems that arise after implemented are found
and dealt with
 May still have resistance due to
• Lack of training
• New culture
 Bain & Company Example

1) Plan
2) Lead
3) Operate
4) Track

www.bain.com
Audit Guidelines for Change Controls

The best practice guidance

Management should use COBiT resources as a
source of best practice guidance

COBiT enables the understanding of:

Business objectives
Communication of best practices
Recommendations to be made
Control Objective: Manage Changes

High-level control objective AI6 states:

The management system should provide for the

analysis, implementation and follow-up of all
changes requested and made to the existing IT
infrastructure.
Manage Changes:
The management system should consider the
following:
Identification of changes
Categorization, prioritization and emergency
procedures
Impact assessment
Change authorization
Release management
Software distribution
Use of automated tools
Configuration management
 Audit Program for Change Controls

Review General Processes

Through interviews, determine:
who prioritizes & justifies changes
how user requests are assigned to programmers
how testing is performed
who approves changes
how edited or new programs are put into production
Adequate guidelines are established to instruct
programming personnel in their duties

Source: See Audit Program Change Control (Under extra readings on topics – change management)
 Audit Program for Change Controls

Specific Process
Completeness
Validity of changes
Adequate involvement
Access control
Emergency changes
One-time changes

Source: See Audit Program Change Control (Under extra readings on topics – change management)
 Audit Program for Change Controls
 Review System Testing for:
Testing procedures performed or checked by persons
other than those involved in writing the programs
Adequate controls to prevent production files from
being used in testing
Adequate testing procedures to prevent any
unauthorized coding from being inserted into
programs during their modifications
Existence of a structured approach to testing based
on the use of test plans
Adequate supervision and segregation of testing
activities
Source: See Audit Program Change Control (Under extra readings on topics – change management)
 Audit Program for Change Controls
 Review User Acceptance Testing
A user acceptance testing sign-off procedure is in
place
User acceptance testing is carried out in an
appropriate environment, isolated from the production
system
Adequate consideration is given to the setting up of
test data
There is a structured approach to testing based on
the use of test plans
Parallel testing is carried out where practical
Volume testing is carried out
Source: See Audit Program Change Control (Under extra readings on topics – change management)
 Audit Program for Change Controls
 Review Testing Environment
Access to the test environment is restricted to only
authorized individuals
IT testing is carried out in an appropriate
environment, isolated from the production system
Adequate consideration is given to the setting up of
the test data
Test environment provides an adequate
representation of the production environment

Source: See Audit Program Change Control (Under extra readings on topics – change management)
 Audit Program for Change Controls

Review Backup and Recovery

Procedures are in place to consider the impact of
change on other applications or to determine need for
upgrading software
Operations regularly backs up production program
libraries, together with a record of changes made
between back-ups
Controls to ensure proper recoverability of program
libraries should a failure occur and that the recovery
process introduces no errors

Source: See Audit Program Change Control (Under extra readings on topics – change management)
Change Management
 Change Management ensures:
 Standardized methods
 Processes and procedures are used for all changes
 Facilitation of efficient and prompt handling of all changes
 Maintaining proper balance between the need for change and the
potential negative impact of changes
Common Traps to avoid!
 1. Misstarts
Change is ill-advised and without sufficient commitment.
 2. Making change an option
Management asks for change instead of enforcing change
 3. A focus only on process
Focus on process not results for initial implementation
 4. A focus only on results
Focus completely on the end result with little concern for problems with change
 5. Not involving those expected to implement the change
Management decides on change without consulting employees
 6. Delegation outside company
Giving outside consultants complete power for change
 7. No change in reward system
If you reward employees the same way you will get the same work
 8. Leadership doesn't walk the talk
Leadership preaches change, but does not set the example
 9. Wrong size
Change is too small or big
 10. No follow-through
Management does not clearly define responsibility and thus the change is not executed properly

Source: http://www.ustyleit.com/Change_Management_Best_Practices.htm
Developing a Change Management Plan

 Raising and recording of changes

 Forecasting the impact, costs, benefits and risk of future
changes
 Developing business justification and obtaining approval
 Managing and coordinating change implementation
 Monitoring and reporting on implementation, reviewing
and closing change requests
Example

Handout: Change Management Plan

http://pma.doit.wisc.edu/plan/3-4/tools.html