2. Definition of Change Management
Process of planning, organizing,
coordinating and controlling the
compositions of the environment, internal
and external; to ensure that the process
changes are implemented according to
approved plans and the overall objectives
of introducing the changes are achieved
with as little disruption as possible.
Oseni, Ezekiel, 10/26/08, “Change Management in Process Change,” 2007, Journal Online.
3. Process Changes
Responsibility of top management
Not only have to manage their employees
but their whole environment that’s
affected:
Suppliers
Customers
Competitors
Can be very draining on finances and
people involved
4. Steps for change:
1) Pre-implementation
Realize the need for change
Determine cost/benefit of new change
Management must support the new change and
display this support to others
• 3 ways to deal with resistance to change
Ignore it
End it by preventing it
Implement crisis management
5. Steps for change:
2) Implementation
Many companies fail before they make it here
Elect a standing committee
• Composed of all departments affected
• Meet on a regular basis
• Meet when problems arise in order to find solutions
Should appreciate all stakeholders for their
patience and understanding
6. Steps for change:
3) Post-implementation
Make sure project achieved planned results
Problems that arise after implemented are found
and dealt with
May still have resistance due to
• Lack of training
• New culture
7. Bain & Company Example
www.bain.com
1) Plan
2) Lead
3) Operate
4) Track
8. Audit Guidelines for Change Controls
The best practice guidance
Management should use COBiT resources as a
source of best practice guidance
COBiT enables the understanding of:
Business objectives
Communication of best practices
Recommendations to be made
9. Control Objective: Manage Changes
High-level control objective AI6 states:
The management system should provide for the
analysis, implementation and follow-up of all
changes requested and made to the existing IT
infrastructure.
10. Manage Changes:
The management system should consider the
following:
Identification of changes
Categorization, prioritization and emergency
procedures
Impact assessment
Change authorization
Release management
Software distribution
Use of automated tools
Configuration management
11. Audit Program for Change Controls
Review General Processes
Through interviews, determine:
who prioritizes & justifies changes
how user requests are assigned to programmers
how testing is performed
who approves changes
how edited or new programs are put into production
Adequate guidelines are established to instruct
programming personnel in their duties
Source: See Audit Program Change Control (Under extra readings on topics – change management)
12. Audit Program for Change Controls
Specific Process
Completeness
Validity of changes
Adequate involvement
Access control
Emergency changes
One-time changes
Source: See Audit Program Change Control (Under extra readings on topics – change management)
13. Audit Program for Change Controls
Review System Testing for:
Testing procedures performed or checked by persons
other than those involved in writing the programs
Adequate controls to prevent production files from
being used in testing
Adequate testing procedures to prevent any
unauthorized coding from being inserted into
programs during their modifications
Existence of a structured approach to testing based
on the use of test plans
Adequate supervision and segregation of testing
activities
Source: See Audit Program Change Control (Under extra readings on topics – change management)
14. Audit Program for Change Controls
Review User Acceptance Testing
A user acceptance testing sign-off procedure is in
place
User acceptance testing is carried out in an
appropriate environment, isolated from the production
system
Adequate consideration is given to the setting up of
test data
There is a structured approach to testing based on
the use of test plans
Parallel testing is carried out where practical
Volume testing is carried out
Source: See Audit Program Change Control (Under extra readings on topics – change management)
15. Audit Program for Change Controls
Review Testing Environment
Access to the test environment is restricted to only
authorized individuals
IT testing is carried out in an appropriate
environment, isolated from the production system
Adequate consideration is given to the setting up of
the test data
Test environment provides an adequate
representation of the production environment
Source: See Audit Program Change Control (Under extra readings on topics – change management)
16. Audit Program for Change Controls
Review Backup and Recovery
Procedures are in place to consider the impact of
change on other applications or to determine need for
upgrading software
Operations regularly backs up production program
libraries, together with a record of changes made
between back-ups
Controls to ensure proper recoverability of program
libraries should a failure occur and that the recovery
process introduces no errors
Source: See Audit Program Change Control (Under extra readings on topics – change management)
17. Change Management
Change Management ensures:
Standardized methods
Processes and procedures are used for all changes
Facilitation of efficient and prompt handling of all changes
Maintaining proper balance between the need for change and the
potential negative impact of changes
18. Common Traps to avoid!
1. Misstarts
Change is ill-advised and without sufficient commitment.
2. Making change an option
Management asks for change instead of enforcing change
3. A focus only on process
Focus on process not results for initial implementation
4. A focus only on results
Focus completely on the end result with little concern for problems with change
5. Not involving those expected to implement the change
Management decides on change without consulting employees
6. Delegation outside company
Giving outside consultants complete power for change
7. No change in reward system
If you reward employees the same way you will get the same work
8. Leadership doesn't walk the talk
Leadership preaches change, but does not set the example
9. Wrong size
Change is too small or big
10. No follow-through
Management does not clearly define responsibility and thus the change is not executed properly
Source: http://www.ustyleit.com/Change_Management_Best_Practices.htm
19. Developing a Change Management Plan
Raising and recording of changes
Forecasting the impact, costs, benefits and risk of future
changes
Developing business justification and obtaining approval
Managing and coordinating change implementation
Monitoring and reporting on implementation, reviewing
and closing change requests
