Change Management

Chris ColombTrish Fullmer

Jordan BloodworthVeronica Beichner

Definition of Change Management

Process of planning, organizing, coordinating and controlling the compositions of the environment, internal and external; to ensure that the process changes are implemented according to approved plans and the overall objectives of introducing the changes are achieved with as little disruption as possible.

Oseni, Ezekiel, 10/26/08, “Change Management in Process Change,” 2007, Journal Online.

Process Changes

Responsibility of top managementNot only have to manage their employees

but their whole environment that’s affected: SuppliersCustomersCompetitors

Can be very draining on finances and people involved

Steps for change:

1) Pre-implementation Realize the need for change

Determine cost/benefit of new change

Management must support the new change and display this support to others• 3 ways to deal with resistance to change

Ignore it End it by preventing it Implement crisis management

Steps for change:

2) Implementation Many companies fail before they make it here Elect a standing committee

• Composed of all departments affected• Meet on a regular basis• Meet when problems arise in order to find solutions

Should appreciate all stakeholders for their patience and understanding

Steps for change:

3) Post-implementation Make sure project achieved planned results Problems that arise after implemented are found

and dealt with May still have resistance due to

• Lack of training• New culture

Bain & Company Example

www.bain.com

1) Plan

2) Lead

3) Operate

4) Track

Audit Guidelines for Change Controls

The best practice guidanceManagement should use COBiT resources as a

source of best practice guidance

COBiT enables the understanding of:Business objectives Communication of best practicesRecommendations to be made

Control Objective: Manage Changes

High-level control objective AI6 states:

The management system should provide for the analysis, implementation and follow-up of all changes requested and made to the existing IT infrastructure.

Manage Changes:The management system should consider the

following:Identification of changesCategorization, prioritization and emergency

proceduresImpact assessmentChange authorizationRelease managementSoftware distributionUse of automated toolsConfiguration management

Audit Program for Change Controls

Review General ProcessesThrough interviews, determine:

who prioritizes & justifies changeshow user requests are assigned to programmershow testing is performedwho approves changeshow edited or new programs are put into production

Adequate guidelines are established to instruct programming personnel in their duties

Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls

Specific ProcessCompletenessValidity of changesAdequate involvementAccess controlEmergency changesOne-time changes

Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls

Review System Testing for:Testing procedures performed or checked by persons

other than those involved in writing the programsAdequate controls to prevent production files from

being used in testingAdequate testing procedures to prevent any

unauthorized coding from being inserted into programs during their modifications

Existence of a structured approach to testing based on the use of test plans

Adequate supervision and segregation of testing activities

Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls

Review User Acceptance TestingA user acceptance testing sign-off procedure is in

placeUser acceptance testing is carried out in an

appropriate environment, isolated from the production system

Adequate consideration is given to the setting up of test data

There is a structured approach to testing based on the use of test plans

Parallel testing is carried out where practicalVolume testing is carried out

Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls

Review Testing EnvironmentAccess to the test environment is restricted to only

authorized individualsIT testing is carried out in an appropriate environment,

isolated from the production systemAdequate consideration is given to the setting up of

the test data Test environment provides an adequate

representation of the production environment

Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls

Review Backup and RecoveryProcedures are in place to consider the impact of

change on other applications or to determine need for upgrading software

Operations regularly backs up production program libraries, together with a record of changes made between back-ups

Controls to ensure proper recoverability of program libraries should a failure occur and that the recovery process introduces no errors

Source: See Audit Program Change Control (Under extra readings on topics – change management)

Change Management

Change Management ensures: Standardized methods Processes and procedures are used for all changes Facilitation of efficient and prompt handling of all changes Maintaining proper balance between the need for change and the

potential negative impact of changes

Common Traps to avoid!

1. MisstartsChange is ill-advised and without sufficient commitment. 

2. Making change an option

Management asks for change instead of enforcing change  3. A focus only on process

Focus on process not results for initial implementation  4. A focus only on results

Focus completely on the end result with little concern for problems with change  5. Not involving those expected to implement the change

Management decides on change without consulting employees 6. Delegation outside company

Giving outside consultants complete power for change  7. No change in reward system

If you reward employees the same way you will get the same work  8. Leadership doesn't walk the talk

Leadership preaches change, but does not set the example  9. Wrong size

Change is too small or big  10. No follow-through

Management does not clearly define responsibility and thus the change is not executed properly

Source: http://www.ustyleit.com/Change_Management_Best_Practices.htm

Developing a Change Management Plan

Raising and recording of changesForecasting the impact, costs, benefits and risk of future

changesDeveloping business justification and obtaining approvalManaging and coordinating change implementationMonitoring and reporting on implementation, reviewing

and closing change requests

Example

Handout: Change Management Plan

http://pma.doit.wisc.edu/plan/3-4/tools.html