1

Change ManagementChange Management

FORFOR

University Medical GroupUniversity Medical Group

Saint Louis UniversitySaint Louis University

Click this icon for Audio

2

AgendaAgenda

• Change Management DefinedChange Management Defined• Process Overview Process Overview • Monitoring Monitoring • Q & AQ & A

3

Change Management - Process of executing and documenting changes that ensures a highly available, consistent, and stable computing environment.

• Ensure standardization across all sites and departments, as well as ensures that all necessary parties are contacted, informed and approve each change request.

• Each requested change is recorded and properly tracked to completion.

• All changes are controlled to provide reasonable assurance that significant changes are authorized and appropriately tested before being moved to production.

DefinitionsDefinitions

4

DefinitionsDefinitions• Functional Manager (FM) – Responsible for the technical operation of the

system or application

• Business Process Owner (BPO) – End user of the system or it’s non-technical manager.

• Key Controls (CM #) - Denotes the key process controls within Change Management identified and approved by the University.

• Change Control Board (CCB) – Formal group of FM, BPO and other key stakeholders responsible for approving, scheduling or rejecting high or urgent changes

• Change Control Manger (CCM) – Responsible for facilitating the process. Is the first point of contact for each Change and can assist throughout the process.

• Change Management Team (CMT) – Formal group of FM, systems application managers and other technical personnel responsible for managing the Change

• Remedy Management System (Remedy) – Request tracking system used to record and document the Change for the CM process

5

CONTROLSCONTROLS

CM1 A formalized documented system for tracking and reporting

CM2 A formalized documented system for approval

CM3 Changes meeting Project criteria must go to Project Office or Senior Management for Approval/Management

CM4 Change Request must have all required documentation

CM5 Change Request must have an Assessment Analysis

CM6 Change Request must have Testing Environment

CM7 Change Requests must have Testing documentation

CM8 Change Requests must have Production Approval

CM9 Change Request must have Production documentation

CM10 Change Request must have documentation of users and process owner approval

CM11 Version Control must be documented and maintained

CM12 Scheduled Service Reviews of Changes made to the Applications

6

• Business Case• Impact & Risk Analysis • Change Build Form• Back Out Plan• Test Plan & Checklist• Communication Plan• Implementation Plan• Acceptance Form• Closure Form

FormsForms

See CM Desk Top Procedures for more information

7

Process OverviewProcess Overview

ForFor

Change ManagementChange Management

8

Initiate Request

Create Remedy Ticket

Change Review

Governing Body Reviews Change

Request andBusiness Case.

Change Assessment Testing

Approve &Implement

Change Closure

Gather Requirements. Create Impact

Analysis, Change Build, & Back Out

Plan

Create Test Plan & Checklist

Communication & Implementation Plan. Complete

Acceptance Form

Closure Form Completed & Audit Trail are available

RemedyCM 1

CM 2, CM 3, CM 4 CM5 CM 6, CM7 CM 8,CM 9,CM 10 CM 10, CM 11, CM

12

Saint Louis University

Change Management Project

For a more detailed outline see the CM Desktop Procedures

Life CycleLife Cycle

9

IT Functional Manager:

1. Creates a Change Request in Remedy

2. Inputs Requestor Log-in information

3. Selects Functional Group to manage Change

Step One: Initiate RequestStep One: Initiate Request

CM Control #1

10

FM will give brief description of the change request in these fields.

FM will input the SLUNET ID of the requestor: additional information will auto-populate.

Initiating Change Request in RemedyInitiating Change Request in Remedy

FM will select his group here

11

Functional Manager:

1. Submit the Change Request to CCM for review:• Selects “CCB” in the Service field• Submits the Business Case Form with the Requestor

2. Performs initial risk assessment • Completes Risk Matrix• Completes CCB Review

3. Determines if this is an emergency• Selects the proper Priority code: “Urgent”

Step Two: Manage Change ReviewStep Two: Manage Change ReviewCM CONTROL # 2 and 3

12

Risk Management Tools For Functional ManagerRisk Management Tools For Functional Manager

After selecting “CCB” in the Service field for review: tabs for performing risk and impact analysis' will appear.

13

Risk Management Tools For Functional ManagerRisk Management Tools For Functional Manager

The Risk of the Change will automatically be determined after the FM completesthese few questions: simply press the “Calculate Risk” button. (The Risk Classification will also auto-populate in the Assessment tab.)

Note the hyperlink “View Required Documentation”

RISK MATRIX

14

Risk Management Tools For Functional ManagerRisk Management Tools For Functional Manager

• Change Classification -- Required Forms

Request PhaseHighlighted Documentation listed below is required for Medium and High Risk changes:1.0  Initiate1.1  Remedy Change Request (always required)2.0 Change Review2.1  Business Case3.0 Change Assessment3.1  Communications Plan3.2  Training Plan (as needed)3.3  Support Plan (as needed)3.4  Risk and Impact Analysis3.5  Change Build Form3.6  Backout Plan4.0  Testing4.1  Test Plan5.0  Approve / Implement

5.1  Acceptance Form5.2  Implementation Plan6.0  Change Closure6.1  Close-Out / Sign Off

Sample of Required Forms for Medium and High Changes

“View Required Documentation”

15

Risk Management Tools For Functional ManagerRisk Management Tools For Functional Manager

Risk Classifications • Four classifications of Risk:

• Low• Medium• High• Urgent

• Managed by one or more of four entities • Change Control Board• Change Control Manager• Departmental Functional Manger• ITS Project Office

• All Risk Assessments Reviewed by Change Control Manager

16

A Change will be assigned to the Functional Manager if:

For Example:– If the change requires immediate (emergency) attention– If the change requires no “down time”– If the change has no interrupt to service

Low/Medium Risk ChangesLow/Medium Risk Changes

Reference: Change Management Risk and Impact Matrix for further details

17

A Change will be assigned to the CCB if:

For Example:– If the change has multiple system dependencies – If the change does not require immediate attention– If the change requires “downtime”– If the change has interruption to services

High Risk ChangesHigh Risk Changes

Reference: Change Management Risk and Impact Matrix for further details

18

A Change will be assigned to the Project Office if:

• The budget of the project is over $25,000 of non-labor expenses• It involves staff from 3 or more ITS departments

one or more of the following:

• It involves more than 300hrs ITS effort• A work schedule that is longer than 3 months• External labor greater than 100 hrs • The project schedule is highly constrained

An ITS project is a defined, approved, temporary effort to produce a unique product or service in support of the University mission.

ITS Project Office - Managed ChangesITS Project Office - Managed Changes

Reference: slu.edu/x11183.xml for further details

19

Documenting “Emergency” changesDocumenting “Emergency” changes

FM can override the Risk Matrix, and note circumstance below.

In the case of an emergency Change, records must be completed post-implementation. FM will select “Urgent” in the Priority field, and fill out the remaining documentation.

20

Risk Management Tools For Functional Manager

CCB REVIEW

The CCB Review questions are forwarded directly to the CCB and CCM: They will assist all stakeholders in managing Medium to High risk Changes.

21

The FM or their designee can attach any documentation on this tab: including confidential material (see right).

Attaching Supporting DocumentationAttaching Supporting Documentation

Labeled “CM Attachments”

There is also a Hyperlink to CM documentation.

CCB Attachments

22

Risk Management Tools For Functional Manager

The final task in the initial Risk and Impact analysis is to input a start and enddate for the Change under the Assessment tab. (can be adjusted later).

Assessment

DON’T FORGET TO SAVE YOUR WORK !!!

23

Step Three: Change AssessmentStep Three: Change Assessment

Functional Manager, CCM or CCB:

1. Reviews and begins approval process

2. Performs a detailed risk assessment• Impact & Risk Analysis Form

3. Gathers requirements and plans resources

4. Identifies personnel involved

5. Develops material and documentation• Change Build Form• Back Out Plan Form

CM CONTROL # 4 and 5

24

Functional Manger, CCM or CCB:

1. Creates a Test Plan and Test Plan Checklist • Identify test cases, scenarios and scripts• Specify test environment requirements• Identify document standards for testing and production environment• Test Plan

2. Completes other forms as required by Functional Manager, CCM or CCB:

• Communication Plan • Training Plan• Support Plan

CM Control # 6 and 7

Step Four: TestingStep Four: Testing

25

Step Five: Approve & ImplementStep Five: Approve & Implement

Functional Manager: Creates an Implementation Plan

• Implementation Form

Functional Manager, CCB, CCM and/or Business Process Owner:

1. Reviews all work against requirements and schedule• Risk & Impact Analysis• Back Out Plan• Change Build Form • Test Plan & Checklist

2. Communicates and Implement Change• Implementation and Communication Forms revisited • Acceptance Form (CCB, CCM and BPO approval)

CM CONTROL # 8,9 and 10

26

Step Six: Change ClosureStep Six: Change Closure

Functional Manager, CCM or CCB:

1. Confirms Version Control with Requester

• Review all forms for correct documentation

2. Finalize Plans and Validates

• Closure Form

CM CONTROL # 10 and 11

27

Change Management Change Management

MonitoringMonitoring

28

Functional Manager, CCB, CCM and Business Process Owner will review reports for the following areas on pre-determined schedule.

1. Segregation of Duties Analysis

2. Reconciliation of CM logs to configuration logs

3. Documentation supporting implementation of CM

CM CONTROL 12

ReportingReporting

29

For Additional InformationFor Additional Information

CONCLUSIONCONCLUSION

Please contact the Quality Assurance Office:

qaoffice@slu.edu