Why do calculate risks on IT Changes?

[RodrigoAlmeida]

I`ve been thinking about a series of reasons to know the value of the risk on IT changes. The matter is: How the value of risk on IT changes can support the change manager's decisions? In what change management activities the risk value can help? I would like to know from you if these reasons are real reasons for companies to interesting in knowing the risk value of an IT change. The reasons are:
1. The risk value will be useful to set the scheduling of changes (i.e., we only can put changes in a change window whose sum of its risks cannot be higher than a pre-defined value X);
2. We will classify changes based in the risk value (for example, determined changes, by its risk value, will be classified as 'high risk changes');
3. We will prioritize changes in change windows (for example: We will implement first the changes with lower risk value. Later, those with higher risk value)
4. We will allocate staff based in the risk value (example: for changes with bigger risk, we will allocate more qualified staff - We will allocate staff and involve product vendors in the change based in the risk value)
5. We can use the risk value to support decisions during the change implementation, like: Time to implement the change, resource allocation…
6. We will use the risk value to determine how detailed our back-out plans will need to be.
7. Any suggestions?

I would like to know from you, if the reasons described above are reasons that you have in mind when you think about risks related to IT changes.

thanks in advance,

Rodrigo Almeida

[UKVIKING]

When I had to make a decision on a specific change as to risk, I would do the follow

What is the service being affected by this change
WHO uses this service
How long would the service be affected
What is the risk if we dont do the change
who and how long would be impacted

and are the system/network/etc engineers capable of dooing the change w/o screwing up - IE havethey done this beofre and how often

I would look at the directly affected and the indirectly affect

It is both a subjective and an objective analyst

I make a preliminary decision and keep it to myself. Then I go back and try to justify the change for & against

Examples

Hardware replacement on a GIGA Switch.

Usually a Card can be hot-swapped from a gigaswitch, especially if the card is bad. However, the card being replaced is not bad and the net engineers want to do this during a peak period because they have staff resource issues. The switch has no low usage time because the other unit in the pair is down for major work. SO I have a SPOF device.

The card needs to be replaced because there is a know fault which will occur which will cause the switch to drop bandwidth

So what is the decision.

If I do nothing, there is a chance of a complete failure of teh switch for a long period (10 minutes+)
If I authorize the h/w swap, there will be a short outage on the VLANs, LANs and bandwidth which were on the card.

So..... what did I do.

My decision was to make this an EMERGENCY Change, due to the change meeting the Emergency change criteria after I involved senior management in the decision making. To be honest, they just went uh uh... what ever you decide john...

Result: notifications went to customers & Service Managers 4 hours before the work being done. Work went off w/o hitch.

I did however have several meeting that week with irate Service Managers but the customers (external) were quite fine on the decision/work
_________________
John Hardesty
ITSM Manager's Certificate (Red Badge)

Change Management is POWER & CONTROL. /....evil laughter

[JoePearson]

In addition to John's answer, Rodrigo, I have some comments on your specific points:

[Globis]