Missing Changes

[lj_180]

Good morning,

May I ask what procedures people have put into place to identify changes that have NOT gone through the correct Change Management process? I would like, eventually, to report on this.


Thanks,
Davey
_________________
Davey
ITIL SLM Practitioner
(Blue Badge)

[UKVIKING]

do you mean undocumented changes

it is hard to catch those because they are undocumented

other than having policies, processes in place to deter this it is diificult

if you are talking about changes that follow the process but not entirely that is what the Post implementationr eview is for
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[UrgentJensen]

Hi,

I would suggest that if you hear of a change not going through the correct process you get the culprit to do the documentation after the fact and pull them into the next CAB to explain why. If you've got adherance to processes in your staff's objectives then it'll work.

What do you want to capture about the change? Well it's worth getting them to the documentation in retrospect simply so you can report on all the normal stuff, but add a flag for 'unauthorised' and have a lessons learnt field to give the fundamental reason for the lapse, e.g. lack of training, discipline, third party unaware. That sort of thing so long as you can feed it back into more effective adoption of the process.

In terms of spotting 'black ops' changes well yes it's very difficult in some parts of the infrastructure but I've seen that some desktop management and 'cmdb' products let you do exception reporting. Basically creating a report of anything that's changed from yesterday to today. Personally I'd rather gouge my own eyes out than sift through that every morning...

[lj_180]

Thanks for the tips.

I guessed it was going to be a case of just "keeping my ear to the ground". As our organisation is not huge (around 1000 users), I might be interested in looking at exception reporting down the line (maybe once a month, so as to keep the eye gouging to a minimum), so if anyone has any recommendations of products that can do this, it would also be apprecaited.

Thanks,
Davey
_________________
Davey
ITIL SLM Practitioner
(Blue Badge)

[asrilrm]

Hi,

Maybe you can record or count the undocumented changes in your KPI, if one of your KPI is "number of changes with no RFCs" or similar

[Skinnera]

We count and report the volume of unathorised Changed when we detect them (usually via a service impact...) but detecting them is the tricky bit!!!

If they go in with no impact, who would ever know that a Change had happened...?

[asrilrm]

Hi Skinnera.
You are absolutely right. It is difficult to detect unauthorized changes at first place. But there should be any audit mechanism that could track documents against reality. By that you could detect any unauthorized change.
The company I work for hasn't come to audit phase in ITIL framework, but currently we have a self developed versioning mechanism that we called "versioning control"

Asril

[dboylan]

One of the best tools for auditing the Change Management process is an accurate CMDB. If the only updates to attributes to CI's are through approved Changes, then auditing the CMDB against the physical state of CI's will show you how well, or poorly, your Change Management process is in maintaining a Controlled state.

[Ines]

Davey,

Really depends on the ITSM tool you are using, and what audit tools compliment. For example, my organisation uses Remedy, and my research has identified Tripwire as providing tools that are easily integrated with Remedy.
We currently use Tivoli (for other purposes as well), and Statseeker, but this potentially only identifies a portion and a specific class of unauthorised changes...I am ever the pessimist!

[asrilrm]

Wow, you really got expensive stuff, although I know tools such as Tivoli could be purchased in a modular basis.
I wonder if my company could provide such tools, we are currently developing with Jira

[Ines]

We're not using tripwire, not sure that we ever will, I just know that it will integrate nicely should we need something more than what we have.
We've had Tivoli for years now, for event management, software dist, backup/restores, inventory scans, and more I'm sure, so it's more than likely cost-effective.