Change Management Chris Colomb Trish Fullmer Jordan Bloodworth Veronica Beichner

Definition of Change Management Process of planning, organizing, coordinating and controlling the compositions of the environment, internal and external; to ensure that the process changes are implemented according to approved plans and the overall objectives of introducing the changes are achieved with as little disruption as possible. Oseni, Ezekiel, 10/26/08, “Change Management in Process Change,” 2007, Journal Online.

Process Changes Responsibility of top management Not only have to manage their employees but their whole environment that’s affected:  Suppliers  Customers  Competitors Can be very draining on finances and people involved

Steps for change: 1) Pre-implementation Realize the need for change Determine cost/benefit of new change Management must support the new change and display this support to others 3 ways to deal with resistance to change  Ignore it  End it by preventing it  Implement crisis management

Steps for change: 2) Implementation Many companies fail before they make it here Elect a standing committee Composed of all departments affected Meet on a regular basis Meet when problems arise in order to find solutions Should appreciate all stakeholders for their patience and understanding

Steps for change: 3) Post-implementation Make sure project achieved planned results Problems that arise after implemented are found and dealt with May still have resistance due to Lack of training New culture

Bain & Company Example 1)Plan 2)Lead 3)Operate 4)Track

Audit Guidelines for Change Controls The best practice guidance  Management should use COBiT resources as a source of best practice guidance COBiT enables the understanding of: Business objectives Communication of best practices Recommendations to be made

Control Objective: Manage Changes High-level control objective AI6 states:  The management system should provide for the analysis, implementation and follow-up of all changes requested and made to the existing IT infrastructure.

Manage Changes: The management system should consider the following:  Identification of changes  Categorization, prioritization and emergency procedures  Impact assessment  Change authorization  Release management  Software distribution  Use of automated tools  Configuration management

Audit Program for Change Controls Review General Processes  Through interviews, determine: who prioritizes & justifies changes how user requests are assigned to programmers how testing is performed who approves changes how edited or new programs are put into production  Adequate guidelines are established to instruct programming personnel in their duties Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls Specific Process  Completeness  Validity of changes  Adequate involvement  Access control  Emergency changes  One-time changes Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls Review System Testing for:  Testing procedures performed or checked by persons other than those involved in writing the programs  Adequate controls to prevent production files from being used in testing  Adequate testing procedures to prevent any unauthorized coding from being inserted into programs during their modifications  Existence of a structured approach to testing based on the use of test plans  Adequate supervision and segregation of testing activities Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls Review User Acceptance Testing  A user acceptance testing sign-off procedure is in place  User acceptance testing is carried out in an appropriate environment, isolated from the production system  Adequate consideration is given to the setting up of test data  There is a structured approach to testing based on the use of test plans  Parallel testing is carried out where practical  Volume testing is carried out Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls Review Testing Environment  Access to the test environment is restricted to only authorized individuals  IT testing is carried out in an appropriate environment, isolated from the production system  Adequate consideration is given to the setting up of the test data  Test environment provides an adequate representation of the production environment Source: See Audit Program Change Control (Under extra readings on topics – change management)

Audit Program for Change Controls Review Backup and Recovery  Procedures are in place to consider the impact of change on other applications or to determine need for upgrading software  Operations regularly backs up production program libraries, together with a record of changes made between back-ups  Controls to ensure proper recoverability of program libraries should a failure occur and that the recovery process introduces no errors Source: See Audit Program Change Control (Under extra readings on topics – change management)

Change Management Change Management ensures:  Standardized methods  Processes and procedures are used for all changes  Facilitation of efficient and prompt handling of all changes  Maintaining proper balance between the need for change and the potential negative impact of changes

Common Traps to avoid! 1. Misstarts Change is ill-advised and without sufficient commitment. 2. Making change an option Management asks for change instead of enforcing change 3. A focus only on process Focus on process not results for initial implementation 4. A focus only on results Focus completely on the end result with little concern for problems with change 5. Not involving those expected to implement the change Management decides on change without consulting employees 6. Delegation outside company Giving outside consultants complete power for change 7. No change in reward system If you reward employees the same way you will get the same work 8. Leadership doesn't walk the talk Leadership preaches change, but does not set the example 9. Wrong size Change is too small or big 10. No follow-through Management does not clearly define responsibility and thus the change is not executed properly Source:

Developing a Change Management Plan Raising and recording of changes Forecasting the impact, costs, benefits and risk of future changes Developing business justification and obtaining approval Managing and coordinating change implementation Monitoring and reporting on implementation, reviewing and closing change requests

Example Handout: Change Management Plan