Corporate Level Change Control

Communication Reduces Risk

Every change introduced into a system carries some risk of destabilizing the system. Manifestations of instability are always embarrasing, often expensive, and sometimes calamatous. To prevent such situations, formal "Change Control" is used to reduce the risk of introducing instability into a system. "Change Control" is a framework of communication and cooperation.

Many Things Affect the System

With software production, the action that causes change is the "release" of a new version. The term "Release Managment" is used to describe the subset of change control that is applicable to software production. There are other forms of change, not related to software that. Prominently, maintenance or modification of infrastructure can degrade or disrupt a system. For example, running diagnostics on a computer might degrade performance for users, and insertion of a router might cause a temprary disruption of connectivity.

A Consensus Approach to Change

"Change Control" is a process by which each party who could possibly be affected by a change gets a chance to examine the consequences of that change, and grant or withhold approval for the timing of that change. The purpose of change control is to assure that proper defensive action has been taken to mitigate risk. It does not inhibit, but rather, it merely alerts others and allows them to vet the proposed action.

Some Companies have a "Board"

Large operations, especially those that can't tolerate disruption, will have a formal "Change Control Board." This Board oversees all changes, (including software releases.) The "Change Control Board" is a nexus for communication; it's primary responsibility is to assess and control risk to the system. A natural consequence is that the Board controls the schedule of changes.

The Change Control Board pro-actively seeks out those who might be affected by a change. Typically, every department of the company has a liason to the Board. The liasons are kept informed of agenda of the Board, and attend Board meetings when the agenda includes an impending change of interest.

Roll-Back Plans, etc.

Typically, the Board will ask "what is the roll-back plan." In other words, if the change creates a problem, how can the change be "undone" so that the system can be returned to stablilty?

Here are some typicaly questions asked by a Change Control Board:

• What is the "roll back" plan?
• Has this been thoroughly tested?
• Who will be available for support?
• Could this be done at a less critical time, like a holiday?
• Is the result worth the risk?