1. 1
A Risk
Management
Approach to
Transform Change
Management
Cyrus Howells
Senior Process Manager – ITSM
At Nationwide Children’s, we are creating the future of pediatric health
care. We are more than a hospital. We are one of America’s largest
pediatric health care and research centers delivering care to more than
one million patient visits each year.
Families travel from around the nation and around the globe to access
life-saving treatments – many unavailable anywhere else.
We are 68 facilities extending out across Ohio and beyond. It’s the
pediatric expertise every child needs.
Here, the future health and potential of all children, is being shaped.
Here, our doctors and researchers are revolutionizing your child’s health
and the health of future generations.
Nationwide Children’s
2December 18, 2015
2. 2
Presentation Objectives
• Starting point
• What we wanted
• Core problem
• The challenge
• A unique approach
• How we implemented this
• Expected and unexpected results
• Next Steps
3December 18, 2015
The Starting Point
• Change Management in place
• Change Advisory Boards in place
• General Acceptance of process
• 10-20 changes reviewed each day
• Competing with other process
improvement efforts.
4December 18, 2015
3. 3
The Challenges
• CAB structure
• Unclear definitions
• Subjective methods (priority, impact, risk)
• Minimal boundaries (lead times, etc.)
5December 18, 2015
The Result
• All changes were treated the same
• High priority, high impact, low risk
• Time consuming CAB meetings
• Focus on the wrong changes
• Little or no time to review
• Changes at wrong time
• Many surprises
• Limited resources to make improvements
6December 18, 2015
4. 4
What We Wanted
• All changes are not the same
• High means high, low means low
• Efficient and effective CAB meetings
• Focus on the right changes
• Adequate time to review
• Changes done at the right time
• No surprises
7December 18, 2015
What does that look like?
8December 18, 2015
5. 5
Change Management Model (example)
9
Pre-approved – no risk
Pre-approved – Low risk
Low
Medium
High
CAB Review
CAB and Service
Owner Approval
Manager and Service
Owner Approval
Manager
approval
Approval by
request type
No
lead time
1- 3 day lead
3-5 day lead
5-10 day lead
morerigidandspecificmoreflexibleandgeneric
December 18, 2015
Core Problem
10
• Risk identification is not sufficient
• All changes are treated the same
• CAB is not focused on right changes
• Lead times is not sufficient
December 18, 2015
6. 6
Core Process Improvements
11
1.Fix the risk calculator
2.Create a categorization model
3.Develop approval matrix
4.Implement lead times
5.Develop acceptance criteria
6.Establish operational readiness reviews
December 18, 2015
RISK
12December 18, 2015
7. 7
The challenge with
traditional risk analysis
13December 18, 2015
How complex is the change?
How easy is it to verify success?
How difficult is it to back out of the change?
Can services be restored within the change window?
Initial Calculator
Too simple!!!!
December 18, 2015 14
8. 8
How complex is the change?
5 – Very complex
3 – More than 3 manual steps
1 – Simple set of well understood steps
How easy is it to verify success?
5 – Complex
3 – Medium
1 – Easy
How difficult is it to back out the change?
5 – Greater than 2 hours
3 – Between 30 minutes and 2 hours
1 – Less than 30 Minutes
Can services be restored within the change window?
0 – Yes
3 – No
Risk Thresholds (Sum)
5 – Low
10 – Medium
15 – High
Insufficient Lead Time
Start is less than 15 hours from now *
Risk = Medium
* Created Time
Initial Calculator
Too subjective!!!!
15December 18, 2015
Elaborate Calculator
Too complex!!!! 16December 18, 2015
9. 9
How complex is the change?
5 – Very complex
3 – More than 3 manual steps
1 – Simple set of well understood steps
How easy is it to verify success?
5 – Complex
3 – Medium
1 – Easy
How difficult is it to back out the change?
5 – Greater than 2 hours
3 – Between 30 minutes and 2 hours
1 – Less than 30 Minutes
Can services be restored within the change window?
0 – Yes
3 – No
Risk Thresholds (Sum)
5 – Low
10 – Medium
15 – High
Insufficient Lead Time
Start is less than 15 hours from now *
Risk = Medium
* Created Time
Initial Calculator
So what calculator do I use?
17December 18, 2015
• Quick
• Simple
• Clear
• Consistent
• Complete
• Foundational
I need…….
18December 18, 2015
10. 10
A unique approach to the
challenge
Using a Hoshin Kanri
technique to calculate risk
versus value
19December 18, 2015
Hoshin Scoring Approach
- Prioritization method
- Develop clear criteria
- 3 point scoring approach
- Don’t get hung up on any particular item
- Tool provides an amplified score by
multiplying all scores
- Set limits (levels) using the scoring
- Can work for risk calculation
20December 18, 2015
11. 11
Example Hoshin Scoring
Savings
3 = Bunch
2 = Some
1 = none
Effort
1 = A lot
Effort
3 = none
2 = A little
1 = A lotEffect on user
3 = none
2 = A little
1 =A lot
21December 18, 2015
Example Hoshin Scoring
Saves a bunch, no effort, no impact
3x3x3 = 27
Saves a bunch, little effort and impact
3x3x2 = 18
Some savings, effort and impact
2x2x2 = 8
Saves nothing, lot of effort, lot of impact
1x1x1 = 1
Management Decision
Do everything 10 or above
Do nothing below 10
Savings
1 = none
Savings
3 = Bunch
2 = Some
1 = none
Effort
1 = A lot
Effort
3 = none
2 = A little
1 = A lot
Effect on user
1 =A lot
Effect on user
3 = none
2 = A little
1 =A lot
22December 18, 2015
12. 12
New Criteria
Impact
Lead time
Complexity
Verification
Back out
ability
Recovery
within
window
End User
Outage
Core systems
Maintenance
Window
23December 18, 2015
Criteria Scoring
Impact
Lead time
Complexity
Verification
Back out ability
Recovery within
window
End User Outage
Core systems
Maintenance
Window
1 – 0-50 users
2 – 50-500 users
3 – 500+ users
1 - GT 5 days
2 – 2-5 days
3 - LT 2 days
1 – simple and single system
2 – complex and one system
3 – Multiple systems
1 - LT 30 minutes
2 - 30 min to 2 hours
3 - GT 2 hours
1 - within window
2 - more than window
3 - Unknown
1 - no
2 - yes - off hour
3 - yes - 7:00 to 5:30
1 – Other tiers
2 – Tier 1
3 – Tier 0
1 - Yes
2 - No - Off Hour
3 - No - 7:00 to 5:30
1 – 1 person
2 – 2 or more
3 – More than a day
24December 18, 2015
13. 13
Establishing levels based on Score
0-49 = Low
50-250 = Medium
GT 250 = High
659 records tested through both calculators
90 resulted in a change of risk
• 18 – Low to High
• 58 – Low to Medium
• 14 – High or Medium to Low
Example: Rightfax – low risk change – failed with impact
There will be exceptions – Change Manager has final say
Initial Levels
25December 18, 2015
Change Management Model (example)
26
Pre-approved – no risk
Pre-approved – Low risk
Low
Medium
High
CAB Review
CAB and Service
Owner Approval
Manager and Service
Owner Approval
Manager
approval
Approval by
request type
No
lead time
1- 3 day lead
3-5 day lead
5-10 day lead
morerigidandspecificmoreflexibleandgeneric
Risk > 250Risk > 250
Risk = 50-250Risk = 50-250
Risk=0-49Risk=0-49
December 18, 2015
14. 14
Examples
Impact
Lead time
Complexity
Verification
Back out ability
Recovery
within window
End User
Outage
Core systems
Maintenance
Window
27December 18, 2015
1 x 1 x 1 x 1 x 1 x 1 x 1 x 1 x 1 = 1
3 x 3 x 3 x 3 x 3 x 3 x 3 x 3 x 3 = 19683
Highest normal change to date = 1944 (scores noted above)
1
3
3 3
3
3 2
2
2
• Establish the concept and initial criteria
• Test criteria (Smell right?)
• Establish initial levels
• Test levels (Smell right?)
• Test, validate, refine
• Challenge
• Communicate, Build, Implement
Not completely linear
Testing to Implementation
28December 18, 2015
15. 15
Expected results
• Easy adoption by practitioners
• Focused change request review
• Simplified CAB process
• Few surprises
• Reduced priority 1 Incidents
29December 18, 2015
Unexpected results
• Minimal revisions to calculator
• More off-hours changes
• Extended lead times
• Refined management homepage
• Different emergency change process
• Focus on maintenance windows
• Slower need for other improvements
30December 18, 2015
16. 16
What’s next?
• Reduce scope of CAB meetings
• High = Individual CAB meetings
• Combined and reduced CAB meetings
• Focus on other process improvements
• Engage business at right levels
31December 18, 2015
Summary
• Not ITIL Island
• Not same for every organization
• Adapt for your environment
• People, process, tool
• Unique, not complex
• Pull versus push behavior change
• Data driven, repeatable, predictable
32December 18, 2015
