Change management involves planning, organizing, coordinating, and controlling changes to ensure they are implemented smoothly with minimal disruption. It is the responsibility of top management to oversee changes that affect suppliers, customers, and competitors. An effective change management process includes pre-implementation planning, implementation, and post-implementation review. It also requires testing changes and obtaining user acceptance before full production rollout. Regular audits help ensure compliance with change control procedures and guidelines.

1. Change Management
Chris Colomb
Trish Fullmer
Jordan Bloodworth
Veronica Beichner

2. Definition of Change Management
Process of planning, organizing,
coordinating and controlling the
compositions of the environment, internal
and external; to ensure that the process
changes are implemented according to
approved plans and the overall objectives
of introducing the changes are achieved
with as little disruption as possible.
Oseni, Ezekiel, 10/26/08, “Change Management in Process Change,” 2007, Journal Online.

3. Process Changes
Responsibility of top management
Not only have to manage their employees
but their whole environment that’s
affected:
 Suppliers
Customers
Competitors
Can be very draining on finances and
people involved

4. Steps for change:
1) Pre-implementation
 Realize the need for change
 Determine cost/benefit of new change
 Management must support the new change and
display this support to others
• 3 ways to deal with resistance to change
 Ignore it
 End it by preventing it
 Implement crisis management

5. Steps for change:
2) Implementation
 Many companies fail before they make it here
 Elect a standing committee
• Composed of all departments affected
• Meet on a regular basis
• Meet when problems arise in order to find solutions
 Should appreciate all stakeholders for their
patience and understanding

6. Steps for change:
3) Post-implementation
 Make sure project achieved planned results
 Problems that arise after implemented are found
and dealt with
 May still have resistance due to
• Lack of training
• New culture

7. Bain & Company Example
www.bain.com
1) Plan
2) Lead
3) Operate
4) Track

8. Audit Guidelines for Change Controls
The best practice guidance
Management should use COBiT resources as a
source of best practice guidance
COBiT enables the understanding of:
Business objectives
Communication of best practices
Recommendations to be made

9. Control Objective: Manage Changes
High-level control objective AI6 states:
The management system should provide for the
analysis, implementation and follow-up of all
changes requested and made to the existing IT
infrastructure.

10. Manage Changes:
The management system should consider the
following:
Identification of changes
Categorization, prioritization and emergency
procedures
Impact assessment
Change authorization
Release management
Software distribution
Use of automated tools
Configuration management

11. Audit Program for Change Controls
Review General Processes
Through interviews, determine:
who prioritizes & justifies changes
how user requests are assigned to programmers
how testing is performed
who approves changes
how edited or new programs are put into production
Adequate guidelines are established to instruct
programming personnel in their duties
Source: See Audit Program Change Control (Under extra readings on topics – change management)

12. Audit Program for Change Controls
Specific Process
Completeness
Validity of changes
Adequate involvement
Access control
Emergency changes
One-time changes
Source: See Audit Program Change Control (Under extra readings on topics – change management)

13. Audit Program for Change Controls
 Review System Testing for:
Testing procedures performed or checked by persons
other than those involved in writing the programs
Adequate controls to prevent production files from
being used in testing
Adequate testing procedures to prevent any
unauthorized coding from being inserted into
programs during their modifications
Existence of a structured approach to testing based
on the use of test plans
Adequate supervision and segregation of testing
activities
Source: See Audit Program Change Control (Under extra readings on topics – change management)

14. Audit Program for Change Controls
 Review User Acceptance Testing
A user acceptance testing sign-off procedure is in
place
User acceptance testing is carried out in an
appropriate environment, isolated from the production
system
Adequate consideration is given to the setting up of
test data
There is a structured approach to testing based on
the use of test plans
Parallel testing is carried out where practical
Volume testing is carried out
Source: See Audit Program Change Control (Under extra readings on topics – change management)

15. Audit Program for Change Controls
 Review Testing Environment
Access to the test environment is restricted to only
authorized individuals
IT testing is carried out in an appropriate
environment, isolated from the production system
Adequate consideration is given to the setting up of
the test data
Test environment provides an adequate
representation of the production environment
Source: See Audit Program Change Control (Under extra readings on topics – change management)

16. Audit Program for Change Controls
Review Backup and Recovery
Procedures are in place to consider the impact of
change on other applications or to determine need for
upgrading software
Operations regularly backs up production program
libraries, together with a record of changes made
between back-ups
Controls to ensure proper recoverability of program
libraries should a failure occur and that the recovery
process introduces no errors
Source: See Audit Program Change Control (Under extra readings on topics – change management)

17. Change Management
 Change Management ensures:
 Standardized methods
 Processes and procedures are used for all changes
 Facilitation of efficient and prompt handling of all changes
 Maintaining proper balance between the need for change and the
potential negative impact of changes

18. Common Traps to avoid!
 1. Misstarts
Change is ill-advised and without sufficient commitment.
 2. Making change an option
Management asks for change instead of enforcing change
 3. A focus only on process
Focus on process not results for initial implementation
 4. A focus only on results
Focus completely on the end result with little concern for problems with change
 5. Not involving those expected to implement the change
Management decides on change without consulting employees
 6. Delegation outside company
Giving outside consultants complete power for change
 7. No change in reward system
If you reward employees the same way you will get the same work
 8. Leadership doesn't walk the talk
Leadership preaches change, but does not set the example
 9. Wrong size
Change is too small or big
 10. No follow-through
Management does not clearly define responsibility and thus the change is not executed properly
Source: http://www.ustyleit.com/Change_Management_Best_Practices.htm

19. Developing a Change Management Plan
 Raising and recording of changes
 Forecasting the impact, costs, benefits and risk of future
changes
 Developing business justification and obtaining approval
 Managing and coordinating change implementation
 Monitoring and reporting on implementation, reviewing
and closing change requests

20. Example
Handout: Change Management Plan
http://pma.doit.wisc.edu/plan/3-4/tools.html