Policing Change Management

[Funk]

Good Morning,

I'm in the process of putting together our Change Management procedures & am struggling over the ways & means we can police this internally to ensure that it gets followed. How have other people approached this?

[Ed]

Hi Funk

What exactly do you mean by policing?

How might this be different when dealing with Third Party suppliers?

Regards

Ed

[Funk]

Hi Ed

What I'm looking for are suggestions about ways we can police the change management process internally to ensure we get people following it - 'carrot' or 'stick' sort of thing - so when we get unauthorised changes being made we can deal with it appropriately. I'm very concious that people here are used to just changing things when they want - like a setting on a live server - & will do there best to circumvent or even ignore this process. We have had several outages in the last 3 months, all of which were a result of changes being made to the live environment.

Cheers

[UKVIKING]

Sigh.

You need to have the following

The change management policy
the change management process
the CM procedures

You need to get the involvement of the managers of the various IT departments who implement the changes and get them to agree to an OLA

Then train their staff

And get Senior mgmt involved.
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[Sen]

Refer the Clause 9.2 of change management.

[Ed]

Even bigger sigh

John has it spot on - we did all of that, and still have problems with people who decide that Change Management processes do not apply to them.

In the end it depends on how good a job you do in selling the idea that best practice means what it says, and that the benefits outweigh the obvious oncosts.

You will need both carrot & stick not just one or the other. It isn't easy, but the sense of acheivement when things go mostly right is fantastic.

Keep plugging away - don't give up - and keep selling ITIL - all day, all the time.

Regards

Ed

[UKVIKING]

You need the appropriate management to say

If you dont follow process...you wil lbe on the disciplinary track

and management has to follow through

if one or two miscreant dont follow through, the above needs to happen to them

the rest will get the hint
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[m_croon]

Hi Funk,

In addition to the remarks already made, I'd like to add this: it is always hard (sometimes impossible) to manage that what you cannot see, in other words it is hard for a proces/change manager to spot unautorized changes, since nobody will spontaneous come up to you and tell you "hey I've just finished this unautorized change, what do you want me to do next..."

Therefor, as a change manager you should start with measuring that what you DO see: start reporting on your proces right away, DON'T WAIT. Reporting will give you allies in the battle for proper change management. Management and service managers will be given the means to understand whats going on in your change mgt proces.

Next, look at your (system mgt) tooling. Is it realy necessary to grant everybody those super/admin rights on the server (where those settings are so easily altered)? Or is it possible to give most people less powerfull accountrights.

Have you looked at streamlining CAB changes? Does CAB have many changes on the agenda that could be standardized? Will people within your organization tend to administer alterations to the infrastructure more easily if they know they do not have to wait for CAB?