Optimize Change Management Rightsize your change management process

Optimize Change Management Right-size your change management process. Info-Tech Research Group, Inc. is a global leader in providing IT research and advice. Info-Tech’s products and services combine actionable insight and relevant advice with ready-to-use tools and templates that cover the full spectrum of IT concerns. © 1997 -2020 Info-Tech Research Group Inc. Info-Tech Research Group 1

ANALYST PERSPECTIVE Balance risk and efficiency to optimize change management. Any significant change to the technical environment – be it a core business application or a critical network/compute/storage appliance – brings a certain element of risk of unplanned consequences. Organizations that prefer to avoid all risk will drown in a burdensome process and red tape, entailed by rounds of technical and configuration reviews. It’s essential to balance the need to mitigate risk while remaining flexible and responsive to the needs of the business. A right-sized process will incorporate adequate due diligence, without being so onerous that sysadmins prefer to bypass the process altogether and implement changes ‘under the radar. ’ Key success factors for any change management initiative include staff buy-in to the need for the control, appropriate processware, an ITSM platform to track the lifecycle of all changes, and visible management support for this foundational activity of any dynamic business. Sumit Chowdhury, Senior Director, Infrastructure Practice Info-Tech Research Group 2

Executive summary Situation Infrastructure and application change occurs constantly, driven by changing business needs, requests for new functionality, operational releases and patches, and resolution of incidents or problems detected by the service desk. IT managers need to follow a standard change management process to ensure that rogue changes are never deployed while the organization remains responsive to demand. Complication • IT system owners often resist change management because they see it • • as slow and bureaucratic. At the same time, an increasingly interlinked technical environment may cause issues to appear in unexpected places. Configuration management systems are often not kept up to date to catch the potential linkages. Infrastructure changes are often seen as “different” from application changes and two (or more) processes may exist. 1. An objective framework for estimating risk is necessary to assess changes. Simply asking “what is the risk? ” will result in subjective responses that will likely minimize the perceived risk. 2. Maximize value through integration with the IT service management ecosystem. Change management in isolation will bring some benefits, but integration with problem, incident, project, configuration, and release management maximizes the ROI. 3. A mature change management process will minimize review and approval activity. Counterintuitively, with experience in implementing changes, risk levels decline to a point where most changes are preapproved. Resolution • Create a unified change management process that reduces risk and is balanced in its approach toward deploying changes while also maintaining throughput of innovation and enhancements. ◦ Categorize changes based on an industry-standard risk model with objective measures of impact and likelihood. ◦ Establish and empower a change manager and change advisory board with the authority to manage, approve, and prioritize changes. ◦ Integrate a configuration management database with the change management process to identify dependencies. Info-Tech Research Group 3

IT change is constant and is driven by: 1 Operational releases and patches MAJOR RELEASE MAINTENANCE RELEASE OPERATIONS Operational releases, maintenance, vendor-driven updates, and security updates can all be key drivers of change. SECURITY PATCH Business-driven changes may include requests from other business departments that require IT’s support. Business requests 2 NEW APP BUSINESS Some incident and problem tickets require a change to facilitate resolution of the incident. SERVICE DESK 3 NEW VERSION CHANGE MANAGEMENT WORKAROUND FIX INCIDENT & PROBLEM Incident or problem tickets In addition to software and hardware asset dependencies, a CMDB is used to keep a record of changes to the infrastructure and is queried to assess change requests. Configuration Management CONFIGURATION MANAGEMENT DATABASE (CMDB) 4 HARDWARE ASSET MANAGEMENT SOFTWARE Info-Tech Research Group 4

Attributes of a change Is this in the production environment of a business process? The core business of the enterprise or supporting functions may be impacted Does the task affect an enterprisemanaged system? Local application = Service Request How many users are impacted? More than a single user (in most cases) Is there a configuration, OR code, OR workflow, OR UI/UX change? Any impact on a business process is a change; adding a user or a recipient to a report or mailing list is NOT a change Does the underlying service currently exist? If it is a new service, this is better described as a project Done/requested by IT It needs to be within the scope of IT for the CM process to apply Info-Tech Research Group 5

Successful change management will provide benefits to both the business and IT Respond to business requests faster, while reducing the number of change-related disruptions. IT Benefits Business Benefits Fewer change-related incidents and outages. Fewer service disruptions. Faster change turnaround time. Faster response to requests for new and enhanced functionality. Higher rate of change success. Higher rate of benefits realization when changes are implemented. Less change rework. Lower cost per change. Fewer service desk calls related to poorly communicated changes. Fewer “surprise” changes disrupting productivity. IT satisfaction with change management will drive business satisfaction with IT. Once the process is working efficiently, staff will be more motivated to adhere to the process, reducing the number of unauthorized changes. As fewer changes bypass proper evaluation and testing, service disruptions will decrease and business satisfaction will increase. Info-Tech Research Group 6

Change management improves core benefits to the business: the four C’s Most organizations have at least some form of change control in place, but formalizing change management leads to the four C’s of business benefits: 1 Control 2 Consistency Change management brings daily control over the IT environment, allowing you to review every relatively new change, eliminate changes that would have likely failed, and review all changes to improve the IT environment. Request for change templates and a structured process shapes implementation, test, and backout plans to be more consistent. Implementing processes for preapproved changes also ensures these frequent changes are executed consistently and efficiently. 3 Collaboration 4 Confidence Change management planning brings increased communication and collaboration across groups by coordinating changes with business activities. The Change Advisory Board (CAB) also brings a more formalized and centralized communication method for IT. Change management processes will give your organization more confidence through more accurate planning, improved execution of changes with less failure, and control over the IT environment. This also leads to greater protection against audits. Info-Tech Research Group 7

You likely need to improve change management more than any other infrastructure & operations process 6. 2 Change Management 8. 6 5. 4 Configuration Management 7. 9 5. 9 Release Management 8. 3 6. 4 Incident & Problem Management 8. 7 6. 1 Availability & Capacity Management 8. 4 6. 3 Operations Management 8. 5 6. 1 Asset Management 8. 1 7. 0 Service Desk 8. 9 0. 0 1. 0 2. 0 3. 0 4. 0 5. 0 6. 0 7. 0 8. 0 9. 0 10. 0 Effectiveness Of the eight infrastructure & operations processes measured in Info-Tech’s IT Management and Governance Diagnostic (MGD) program, change management has the 2 nd largest gap between importance and effectiveness of these processes. Twenty-one percent of organizations who have completed this diagnostic were classified as needing to improve change management based on these scores. More organizations need to improve change management than any other infrastructure & operations process. Importance Source: Info-Tech; N=10, 719 IT Professionals from 1364 organizations Info-Tech Research Group 8

Executives and directors recognize the importance of change management but feel theirs is currently ineffective 10. 0 8. 8 9. 0 8. 7 8. 6 8. 0 MGD Score 7. 0 6. 7 6. 3 5. 8 6. 0 5. 9 Info-Tech’s IT Management and Governance Diagnostic (MGD) program assesses the importance and effectiveness of core IT processes. Since its inception, the MGD has consistently identified change management as an area for immediate improvement. 5. 0 4. 0 3. 0 Importance Scores 2. 0 No Importance: 1. 0 -6. 9 Limited Importance: 7. 0 -7. 9 Significant Importance: 8. 0 -8. 9 Critical Importance: 9. 0 -10. 0 1. 0 0. 0 Frontline Manager Director Executive Seniority Level Change Management - Effectiveness Change Management - Importance Effectiveness Scores Not in Place: N/A Not Effective: 0. 0 -4. 9 Somewhat Ineffective: 5. 0 -5. 9 Somewhat Effective: 6. 0 -6. 9 Very Effective: 7. 0 -10. 0 Source: Info-Tech; N=10, 719 IT Professionals from 1364 organizations Info-Tech Research Group 9

You are not alone… Many organizations suffer from the lack of a defined change management process. We found that people were making changes ad hoc into production. This would result in change-related incidents. – Senior Director, Technology and Managed Services We are always struggling with utilization, and I think [this] is because of a lack of user knowledge. – CIO, Claims Management Provider By not pre-planning changes far in advance, we are forced to give the change management form at the eleventh hour (…) Because of these time frame issues, we don’t require proof of testing prior to change, and that’s a big gap. – Assistant Director of Technology Solutions, Municipal Government Services We only recognize dependencies after deployment. – Siebel Systems Administrator Info-Tech Research Group 10

Overcome perceived challenges to implementing change management to reap measurable reward Before: Informal Change Management After: Right-Sized Change Management Change Approval: Changes do not pass through a formal review process before implementation. 10% of released changes are approved • Implementation Challenge: Staff will resist having to submit formal change requests and assessments, frustrated at the prospect of having to wait longer to have changes approved. Change Approval: All changes pass through a formal review process. Once a change is repeatable and welltested, it can be preapproved to save time. Almost no unauthorized changes are deployed. Change Prioritization: Changes are not prioritized according to urgency, risk, and impact. 60% of changes are urgent • Implementation Challenge: Influential stakeholders accustomed to having changes approved and deployed might resist having to submit changes to a standard cost-benefit analysis. Change Prioritization: The CAB prioritizes changes so that the business is satisfied with the speed of change deployment. Change Deployment: Changes often negatively impact user productivity. 25% of changes are realized as planned. • Implementation Challenge: Engaging the business so that formal change freeze periods and regular maintenance windows can be established. Change Deployment: Users are always aware of impending changes and changes do not interrupt critical business activities. 95% of changes are approved • KPI: Decrease in change-related incidents. 35% of changes are urgent • KPI: Decrease in change turnaround time. Over 80% of changes are realized as planned • KPI: Decrease in the number of failed deployments. Info-Tech Research Group 11

Info-Tech draws on the COBIT framework, which focuses on consistent delivery of IT services across the organization Info-Tech Research Group 12

Info-Tech’s framework for implementing change management aligns with both COBIT and ITIL 1 Request – RFC is submitted to solve a problem BAI 06. 01 Evaluate, prioritise, and authorise change requests. 2 Assess – Changes are discussed and prioritized BAI 06. 02 Manage emergency changes 3 Approval – Develop business justification and obtain approval BAI 06. 03 Track and report change status BAI 06. 04 Close and document the changes 1. Assess 2. Build Process 3. Implement 4 Implement – Changes are submitted to change management for deployment 5 Measurement & reporting – Review KPIs and metrics and document changes 4. Measure & Improve Info-Tech Research Group 13

Change management is a key component in stabilizing your IT environment Continual Service Improvement Strategic Partner Service Portfolio Management Availability Management Demand Management Service Level Management Service Metrics Service Catalog Business Relationship Management Service Provider • Create a service catalog that documents services from the user perspective • Measure service performance, based on business-oriented metrics Configuration Management Service Continuity Management Capacity & Performance Management Event Management + Monitoring & Alerting Asset Management Change Management Release & Deployment Management Problem Management Incident Management Service Desk Proactive • Understand your environment and take action to: o Avoid/prevent service disruptions o Improve quality of service (performance, availability, reliability) Stabilize • • Deliver stable, reliable IT services to the business Respond to user requests quickly and efficiently Resolve user issues in a timely manner Deploy changes smoothly and successfully Info-Tech Research Group 14

Info-Tech’s approach to change management optimization focuses on building standardized processes Phase 1: Form Strategy Phase 2: Build Core Change Process Phase 3: Define Change Support Processes Phase 4: Build Implementation Plan 1. 1 Assess CM maturity 2. 1 Determine roles + responsibilities 3. 1 Create change intake process 4. 1 Identify metrics and build change calendar 1. 2 Build risk prioritization and categorization scheme 2. 2 Build core change processes 3. 2 Establish postimplementation activities 4. 2 Implement project Outcomes + Deliverables Change management standard operating procedures (SOP) • Maturity Assessment Tool • Risk Assessment Tool • RACI Chart & Role Descriptions • Request For Change Process • Change Calendar Guidelines • CAB Charter • Request For Change (RFC) Form • Metrics and Reports • Change Metrics Tool • Core Process Workflows • Emergency Change Process Workflow • Pre-Implementation Checklist • Post-Implementation Review Checklist • Communication Plan • Executive Presentation • Implementation Gantt Chart • Sunshine Diagram Info-Tech Research Group 15

Optimize change management using Info-Tech’s methodology to get measurable results More than a hundred organizations engaged with Info-Tech for their change management projects through advisory calls and workshops. Their goal was either to improve their existing processes or build them from scratch. Organizations who estimated the business impact of each project phase help us shed light on the average measured value of the engagements. The change management workshop isn't just about theory or the concepts that you can find in a book. The Info-Tech facilitators help transform the program to face and manage your challenges, improving operations and collaboration among different departments. US$853, 247. 23 Sum of Measured Value Dollar Impact Average Measured Value Dollar Impact 20. 26 Days US$14, 461. 82 Average Measured Value Time Saved – Juan Batista, VP of IT Apple Federal Credit Union Source: Info-Tech Research Group, 2019 (N=59) Info-Tech Research Group 16

Info-Tech delivers: Use our tools and templates to accelerate your project to completion Process Workflows Change Management Roadmap Change Management Pre -Implementation and Post -Implementation Checklists Change Management Standard Operating Procedure (SOP) Change Management Risk Assessment Tool Info-Tech Research Group 17

These case studies illustrate the value of each phase of the project A major technology company implemented change management to improve productivity by 40%. This case study illustrates the full scope of the project. A large technology firm experienced a critical outage due to poor change management practices. This case study illustrates the scope of the strategy phase. A manufacturing company created a makeshift CMDB in the absence of a CMS to implement change management. This case study illustrates the scope of the intake phase. Ignorance of change management process led to a technology giant experiencing a critical cloud outage. This case study illustrates the scope of the process phase. A financial institution tracked and recorded metrics to aid in the success of their change management program. This case study illustrates the scope of the implementation phase. Assess maturity Design risk assessment process Standardize change processes Implement Info-Tech Research Group 18

Working through this project with Info-Tech can save you time and money Engaging in guided implementations doesn’t just offer valuable project advice, it also results in significant cost savings. GI Measured Value Phase 1: Form strategy • We estimate Phase 1 activities will take 2 FTEs 10 days to complete on their own, but the time saved by using Info-Tech’s methodology will cut that time in half, thereby saving $3, 100 (2 FTEs * 5 days * $80, 000/year) Build core process • We estimate Phase 2 will take 2 FTEs 10 days to complete on their own, but the time saved by using Info-Tech’s methodology will cut that time in half, thereby saving $3, 100 (2 FTEs * 5 days * $80, 000/year) Phase 3: Define change support processes • We estimate Phase 3 will take 2 FTEs 10 days to complete on their own, but the time saved by using Info-Tech’s methodology will cut that time in half, thereby saving $3, 100 (2 FTEs * 5 days * $80, 000/year) Phase 2: • We estimate Phase 4 will take 2 FTEs 5 days to complete on their own, but the time saved by using Info-Tech’s methodology will cut that time in half, thereby saving $1, 500 (2 FTEs * Build implementation plan 2. 5 days * $80, 000/year) Phase 4: Total savings $10, 800 Info-Tech Research Group 19

Intel implemented a robust change management program and experienced a 40% improvement in change efficiency CASE STUDY Industry Source Technology Intel Founded in 1968, the world’s largest microchip and semiconductor company employs over 100, 000 people. Intel manufactures processors for major players in the PC market including Apple, Lenovo, HP, and Dell. Assess maturity ITIL Change Management Implementation With close to 4, 000 changes occurring each week, managing Intel’s environment is a formidable task. Before implementing change management within the organization, over 35% of all unscheduled downtime was due to errors resulting from change and release management. Processes were ad hoc or scattered across the organization and no standards were in place. Results After a robust implementation of change management, Intel experienced a number of improvements including automated approvals, the implementation of a formal change calendar, and an automated RFC form. As a result, Intel improved change productivity by 40% within the first year of implementation. Design risk assessment process Standardize change processes Implement Info-Tech Research Group 20

Use these icons to help direct you as you navigate this research Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities. This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project. This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization. Info-Tech Research Group 21

Info-Tech offers various levels of support to best suit your needs DIY Toolkit “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful. ” Guided Implementation “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track. ” Workshop “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place. ” Consulting “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project. ” Diagnostics and consistent frameworks used throughout all four options Info-Tech Research Group 22

Optimize Change Management – project overview Form Strategy Build Core Processes Build Support Processes Plan Implementation 1. 1 Assess change management maturity 2. 1 Determine roles and responsibilities 3. 1 Create change intake process 4. 1 Identify metrics and build change calendar 1. 2 Build risk prioritization and categorization scheme 2. 2 Build core change processes 3. 2 Establish postimplementation activities 4. 2 Implement project Best-Practice Toolkit Introduce change concepts Review roles & responsibilities Define change intake process Review metrics Assess maturity Define changes Build risk assessment scheme Review core change processes Create re-implementation checklist and postimplementation review checklist Create roadmap Review emergency change processes Guided Implementations Info-Tech Research Group 23

Optimize Change Management – workshop overview Deliverables Activities Contact your account representative or email Workshops@Info. Tech. com for more information. Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4 Assess Maturity and Determine Gaps Build Core Processes Build Support Processes Build Implementation Plan 1. 1 Outline strengths and challenges. 1. 2 Conduct maturity assessment. 1. 3 Build categorization scheme. 1. 4 Build risk assessment matrix. 1. Maturity Assessment 2. Risk Assessment Matrix 3. RACI Chart 2. 1 Define change manager role. 2. 2 Outline CAB protocol. 2. 3 Determine change team roles & responsibilities. 2. 4 Build normal change process. 2. 5 Build emergency change process. 2. 6 Build preapproved change process. 3. 1 Create RFC template. 3. 2 Create RFC process. 3. 3 Determine postimplementation review activities 4. 1 Identify metrics & reports. 4. 2 Build change calendar. 4. 3 Create communication plan. 4. 4 Build implementation roadmap. 1. Change Manager Job Description 2. CAB Charter 3. RFC Template 4. Normal Change Process 5. Emergency Change Process 6. Preapproved Change Process 1. Change Intake Process 2. Pre-implementation checklist 3. Post-Implementation Review Process 1. Standard Operating Procedure 2. Communication Deck 3. Project Roadmap Info-Tech Research Group 24