I85PREP
⌘ K
Change Mgmt study materials
Change Mgmt study resources

Change Mgmt practice questions

One question at a time. Build your Change Mgmt understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Change management knowledge (up to SFIA level 3)

In change management, what is the primary purpose of a Request for Change (RFC)?

  1. To formally propose a modification to a configuration item or service and initiate its assessment Correct answer.
  2. To record the final closure details of an incident that affected a service
  3. To document the agreed service levels between a provider and a customer
  4. To list all configuration items held within the configuration management database

Explanation

An RFC is the formal trigger that starts the change lifecycle: it captures what is to be changed, why, and the intended outcome so that the change can be assessed, authorised and scheduled. Incidents, service level agreements and configuration records are separate artefacts with different purposes.

Question 2Change management knowledge (up to SFIA level 3)

Which description best matches a standard change?

  1. A change implemented under emergency conditions to restore a failed service
  2. A change that is pre-authorised because it is low risk, well understood and follows a documented procedure Correct answer.
  3. A change that must be escalated to the change advisory board every time it is raised
  4. A change whose impact cannot be determined until after implementation

Explanation

Standard changes are recurring, low-risk and repeatable, so they are pre-authorised and executed through an agreed procedure without individual CAB review. This keeps routine work flowing while reserving assessment effort for higher-risk changes.

Question 3Change management knowledge (up to SFIA level 3)

What is the main role of the Change Advisory Board (CAB)?

  1. To negotiate commercial contracts with external suppliers
  2. To assess, prioritise and advise on changes so that informed authorisation decisions can be made Correct answer.
  3. To own the incident management process end to end
  4. To implement all approved changes personally across the estate

Explanation

The CAB is an advisory body that reviews change requests, considers risk, impact and resource needs, and recommends a course of action to the change authority. It does not itself perform the technical implementation or own unrelated processes.

Question 4Change management knowledge (up to SFIA level 3)

Which statement correctly distinguishes a change from a release?

  1. A change is the rollback plan; a release is the deployment script
  2. A change and a release are synonyms and can be used interchangeably in all contexts
  3. A change is the addition, modification or removal of anything affecting services; a release is a version made available for use Correct answer.
  4. A change is always a software build; a release is the approval meeting that authorises it

Explanation

Change management governs the lifecycle of modifications to services and their components, while release and deployment management builds, tests and makes a version available to users. One release can carry multiple changes, so the terms are related but not interchangeable.

Question 5Change management knowledge (up to SFIA level 3)

Why is a change freeze period commonly applied, for example during peak trading?

  1. To reduce the risk of disruption during a period when service failure would have the greatest business impact Correct answer.
  2. To remove the need for any change records during that period
  3. To give technical staff a scheduled holiday from all operational duties
  4. To permanently retire all standard changes from the catalogue

Explanation

A freeze restricts non-essential changes when the cost of disruption is highest, protecting critical business activity. Emergency changes are still handled through defined exception routes, and records continue to be maintained.

Question 6Change management knowledge (up to SFIA level 3)

What does the '7 Rs' concept help a change practitioner evaluate?

  1. The raised-by, reason, return, risks, resources, responsible party and relationships of a change Correct answer.
  2. The seven servers that must be restarted after every deployment
  3. The seven approval signatures required before any standard change
  4. The seven-year retention period for change records

Explanation

The 7 Rs provide a structured set of questions covering who raised the change, why, what benefit it brings, the risks, the resources needed, who is accountable and how it relates to other changes. Together they support a consistent assessment of a request.

Question 7Change management knowledge (up to SFIA level 3)

Which item is typically an output of a change assessment rather than an input?

  1. The business justification supplied by the sponsor
  2. The change request submitted by the requester
  3. The configuration item details held in the CMDB
  4. A recommendation on risk, impact and scheduling for the change authority Correct answer.

Explanation

Assessment consumes the request, configuration data and justification, and produces advice such as risk rating, impact analysis and a proposed schedule. The recommendation is therefore the output that informs authorisation.

Question 8Change management knowledge (up to SFIA level 3)

What is the purpose of a change implementation plan?

  1. To list the service level targets for the coming year
  2. To define the sequence of steps, responsibilities, timings and backout arrangements for executing an approved change Correct answer.
  3. To describe the organisational chart of the IT department
  4. To record the minutes of the change advisory board meeting

Explanation

An implementation plan translates an authorised change into an executable sequence, assigning who does what and when, and specifying how to reverse the change if it fails. It is the practical bridge between approval and delivery.

Question 9Change management knowledge (up to SFIA level 3)

A service desk analyst raises a change to apply a vendor-supplied security patch. The patch is mandatory, tested in a pilot group and applied monthly using a documented script. How should this change most appropriately be classified?

  1. As a normal change needing full assessment each month
  2. As a change that should be rejected because patches are operational work
  3. As an emergency change requiring immediate CAB escalation
  4. As a standard change executed under the pre-authorised procedure Correct answer.

Explanation

The change is recurring, low risk, tested and governed by an agreed procedure, which are the defining characteristics of a standard change. Pre-authorisation lets it proceed predictably without repeated full assessment.

Question 10Change management knowledge (up to SFIA level 3)

A change fails during deployment and the service is degraded. According to good change management practice, what should happen first?

  1. Invoke the backout plan to restore the previous known-good state, then record and review the outcome Correct answer.
  2. Delete the change record so that the failure is not audited
  3. Close the change record as successful to avoid reporting delays
  4. Continue the deployment to completion and assess the damage afterwards

Explanation

A predefined backout plan exists precisely to restore service quickly when a change fails, after which the failure is documented and reviewed to learn from it. Continuing or concealing the problem increases business impact and breaks audit integrity.

Question 11Change management knowledge (up to SFIA level 3)

During assessment, a change is found to affect a shared database used by three other critical services. What is the most appropriate action?

  1. Escalate the assessment to include the owners of the dependent services before authorisation Correct answer.
  2. Proceed and inform the other service owners after implementation
  3. Approve the change immediately because it has already been requested
  4. Reject the change automatically because it touches a shared component

Explanation

Shared components create dependencies that widen the impact of a change, so the affected service owners must contribute to the risk assessment before a decision is made. Informing them only afterwards removes any chance to mitigate cross-service disruption.

Question 12Change management knowledge (up to SFIA level 3)

A major incident requires an urgent fix outside the normal schedule. Which approach best reflects emergency change practice?

  1. Wait for the next scheduled CAB meeting before taking any action
  2. Implement the fix with no record because speed is the only priority
  3. Apply the fix under a defined emergency procedure with retrospective documentation and review Correct answer.
  4. Raise a standard change and follow the routine pre-authorised route

Explanation

Emergency change procedures allow rapid action through a designated authority, with documentation and review completed afterwards so that governance is preserved despite the urgency. Waiting for a routine meeting or abandoning records both create worse outcomes.

Question 13Change management knowledge (up to SFIA level 3)

A change request lacks a clear business justification and has no identified owner. What should the change authority do?

  1. Forward it directly to implementation to save time
  2. Return the request to the requester for the missing information before assessing it further Correct answer.
  3. Approve it provisionally and look for a justification later
  4. Reject it permanently and ban the requester from raising changes

Explanation

Assessment depends on knowing why a change is needed and who is accountable for it; without these, risk and benefit cannot be judged. Returning the request for completion is the proportionate response and keeps the process moving.

Question 14Change management knowledge (up to SFIA level 3)

Why should a change schedule be maintained and made visible to operational teams?

  1. To coordinate changes, avoid conflicting deployments and give operations visibility of upcoming disruption Correct answer.
  2. To replace the need for any change records or approvals
  3. To determine individual performance bonuses
  4. To rank staff by the number of changes they raise

Explanation

A forward schedule of change lets teams spot collisions, sequence dependent work and prepare for service impact. It supports coordination and communication but does not substitute for records or authorisation.

Question 15Change management knowledge (up to SFIA level 3)

After a successful change, what is the most valuable closure activity?

  1. Confirm the intended outcome was achieved, update records and capture lessons for future changes Correct answer.
  2. Reassign the change to a different team for a second implementation
  3. Immediately delete all related documentation to save storage
  4. Reopen the change as a new request to double-check the work

Explanation

Closure verifies that the change delivered its intended result, ensures configuration and knowledge records reflect reality, and captures lessons that improve later changes. It is the point at which the change lifecycle is properly completed.

Question 16Change management knowledge (up to SFIA level 3)

A change is assessed as high risk with significant potential customer impact. Which authorisation approach is most appropriate?

  1. Treat it as a standard change because it has been raised before
  2. Let the original requester self-approve it to speed things up
  3. Refer it to a senior change authority with the necessary delegated power and full assessment information Correct answer.
  4. Approve it silently without communicating to affected stakeholders

Explanation

High-risk changes should be decided by an authority with sufficient delegated power, supported by complete assessment information and appropriate stakeholder communication. Self-approval or silence removes the scrutiny that high-impact changes require.

Question 17Change management knowledge (up to SFIA level 3)

What distinguishes a change model from a change procedure?

  1. A model defines the steps and roles for a type of change, while a procedure gives detailed work instructions for carrying them out Correct answer.
  2. A model is optional documentation, while a procedure is legally binding
  3. A model is a software tool, while a procedure is a written policy
  4. A model applies only to emergency changes, while a procedure applies only to standard changes

Explanation

Change models set out the stages, roles and decision points appropriate to a category of change, whereas procedures describe the granular steps people follow. Models provide the structure; procedures provide the how-to detail.

Question 18Change management knowledge (up to SFIA level 3)

A team wants to reduce assessment effort for low-risk changes while retaining control. Which approach best achieves this?

  1. Remove all authorisation for every change regardless of risk
  2. Stop recording changes so that assessment effort disappears
  3. Define standard change templates with pre-agreed risk criteria and periodic review of their continued suitability Correct answer.
  4. Require full CAB review for every change including trivial ones

Explanation

Pre-authorised standard changes with clear criteria cut routine overhead while periodic review ensures the criteria still reflect actual risk. This balances efficiency with control, unlike removing or over-applying governance.

Question 19Change management knowledge (up to SFIA level 3)

Why is segregation of duties important between the person who authorises a change and the person who implements it?

  1. It guarantees that every change will succeed without failure
  2. It reduces the risk that a single individual can introduce unauthorised or unchecked modifications Correct answer.
  3. It allows the implementer to skip recording the change
  4. It removes the need for any testing before deployment

Explanation

Separating authorisation from execution creates a control that prevents one person from both proposing and enacting a change without oversight. It lowers the risk of error or misuse but cannot guarantee success or replace testing and record-keeping.

Question 20Change management knowledge (up to SFIA level 3)

A change is approved but its planned window clashes with a major sporting event expected to drive peak traffic. What is the best response?

  1. Implement during the event but disable monitoring to avoid alerts
  2. Reschedule the change to a lower-risk window after reassessing the impact on peak load Correct answer.
  3. Proceed as planned because authorisation has already been granted
  4. Cancel the change permanently and never revisit it

Explanation

Authorisation covers the change itself, not an unsuitable timing that has since become apparent; reassessing and moving to a safer window protects the service. Proceeding blindly or disabling monitoring during peak load would magnify any failure.

Question 21Change management knowledge (up to SFIA level 3)

What is the primary reason for maintaining an auditable trail of change records?

  1. To measure how many changes each team can avoid raising
  2. To demonstrate that changes were authorised, tested and reviewed in line with agreed controls Correct answer.
  3. To replace the configuration management database entirely
  4. To provide marketing material for customer presentations

Explanation

An audit trail provides evidence that the organisation followed its own controls for authorisation, testing and review, which supports compliance and post-incident investigation. It is a governance record, not a marketing or avoidance metric.

Question 22Change management knowledge (up to SFIA level 3)

A change has a high likelihood of failure but low impact if it fails. How should a risk-based assessment treat this?

  1. Ignore the likelihood and consider only the impact
  2. Treat it as maximum risk because likelihood alone determines severity
  3. Weigh likelihood against impact to set proportionate controls, accepting that low impact may justify a lighter backout approach Correct answer.
  4. Reject it automatically because any likelihood of failure is unacceptable

Explanation

Risk combines likelihood and impact, so a probable but low-impact failure may warrant simpler safeguards than a rare catastrophic one. Proportionate controls match the actual exposure rather than reacting to one factor in isolation.

Question 23Change management knowledge (up to SFIA level 3)

Two approved changes are scheduled for the same maintenance window and both modify the same authentication service. What is the most sound course of action?

  1. Run both simultaneously to save time and fix any conflicts afterwards
  2. Proceed with the larger change and silently drop the smaller one
  3. Cancel both permanently because they share a component
  4. Assess the interaction between the changes and resequence or combine them to avoid conflicting modifications Correct answer.

Explanation

Changes that touch the same component can interact unpredictably, so their combined effect must be assessed and their execution sequenced or merged deliberately. Running both at once or unilaterally dropping one risks undetected conflict and untested outcomes.

Question 24Change management knowledge (up to SFIA level 3)

Why should emergency changes still be reviewed after implementation even though they bypass normal pre-authorisation?

  1. It allows the organisation to punish the staff who raised the emergency
  2. It proves that emergency procedures should be abolished
  3. Retrospective review confirms the change was justified, captures lessons and ensures records and configuration data are corrected Correct answer.
  4. It removes the need to update the configuration management database

Explanation

Retrospective review restores the control that urgency forced to be deferred: it validates the decision, records what happened and corrects configuration data. This closes the loop without slowing the emergency response itself.

Question 25Change management knowledge (up to SFIA level 3)

An organisation finds that most change failures originate from incomplete impact analysis. Which improvement is most likely to address the root cause?

  1. Reduce the number of people involved in assessment to speed decisions
  2. Strengthen the assessment step with mandatory dependency checks and clearer impact criteria before authorisation Correct answer.
  3. Shorten the change record to capture fewer details
  4. Move authorisation earlier so implementation can begin sooner

Explanation

If failures trace back to incomplete impact analysis, the effective remedy is to reinforce that step with explicit dependency checks and criteria so decisions rest on adequate information. Loosening records or accelerating approval would worsen the underlying weakness.

Question 26Change management knowledge (up to SFIA level 3)

In change management, what is the main purpose of a change advisory board (CAB)?

  1. To provide advice and recommendations on change assessment, prioritisation and scheduling Correct answer.
  2. To own the configuration management database
  3. To negotiate supplier contracts for change tools
  4. To implement every approved change personally

Explanation

A CAB is a consultative body that reviews change proposals and advises on risk, impact, scheduling and prioritisation. It supports the change authority but does not normally execute changes itself or own operational data and contracts.

Question 27Change management knowledge (up to SFIA level 3)

Which statement best describes a 'standard change'?

  1. A change raised only after a major incident has occurred
  2. A change that must always be approved by the CAB at a scheduled meeting
  3. A pre-authorised, low-risk change with a documented procedure that can be raised without further approval Correct answer.
  4. A change that bypasses all recording because it is routine

Explanation

Standard changes are low-risk, repeatable changes that are pre-authorised so they can be actioned quickly using a defined procedure. They still need to be recorded and reviewed periodically, but they skip case-by-case authorisation.

Question 28Change management knowledge (up to SFIA level 3)

What is the key difference between a normal change and an emergency change?

  1. Normal changes are never recorded in the change log
  2. Emergency changes cannot be reviewed after implementation
  3. Normal changes do not require any risk assessment
  4. Emergency changes are assessed and authorised through an expedited route because delay would cause significant harm Correct answer.

Explanation

Emergency changes exist to resolve incidents or severe risks quickly, so they use a faster, lighter authorisation path. Both types are recorded and both are subject to risk consideration; the difference is the speed and formality of the route.

Question 29Change management knowledge (up to SFIA level 3)

Which element belongs in a change record from the moment it is raised?

  1. The supplier invoice for the change
  2. The measured benefit realised six months later
  3. A unique identifier and a description of what is to be changed Correct answer.
  4. The final post-implementation review sign-off

Explanation

A change record must be uniquely identifiable and describe the intended change so it can be tracked and assessed. Post-implementation review, realised benefits and invoices are produced later, if at all, and are not initial record contents.

Question 30Change management knowledge (up to SFIA level 3)

What does the change authority do when a proposed change is assessed as unacceptable?

  1. Forward it directly to implementation without comment
  2. Delete the change record to keep the log clean
  3. Approve it but remove it from the schedule
  4. Decline or reject the change and record the reason for the decision Correct answer.

Explanation

The change authority decides whether a change proceeds; if the risk or justification is unacceptable it declines the change and records why. The record is retained so the decision is auditable, and rejection is not the same as quietly scheduling it.

Question 31Change management knowledge (up to SFIA level 3)

Why should the scope of a change be clearly defined before assessment?

  1. So the implementer can decide the risk level without any input
  2. So the change can avoid being recorded in the change log
  3. So the components, services and stakeholders affected can be identified and assessed consistently Correct answer.
  4. So the change automatically becomes a standard change

Explanation

Clear scope lets assessors identify which configuration items, services and users are affected, which underpins risk and impact analysis. Without it, assessment is guesswork and dependencies are easily missed.

Question 32Change management knowledge (up to SFIA level 3)

What is the role of a change manager in the change enablement practice?

  1. Coordinating the change process, ensuring changes are assessed, authorised, scheduled and reviewed Correct answer.
  2. Performing every technical deployment personally
  3. Writing all application code for every change
  4. Owning the organisation's financial budget

Explanation

The change manager facilitates the end-to-end change flow: ensuring proposals are assessed, authorised, scheduled and reviewed. The role is coordinative and does not involve personally building or deploying all changes.

Question 33Change management knowledge (up to SFIA level 3)

What is the purpose of a change freeze period?

  1. To protect a period of critical business activity by restricting non-essential changes Correct answer.
  2. To replace the need for a change schedule
  3. To allow changes to be implemented without any assessment
  4. To permanently stop all change activity in the organisation

Explanation

A change freeze temporarily restricts changes during a sensitive period, such as a financial year-end or peak trading season, to reduce risk. It is time-bound and normally still permits emergency changes with appropriate authorisation.

Question 34Change management knowledge (up to SFIA level 3)

A change owner proposes to deploy a new reporting service. During assessment it emerges that the service will read from a production data warehouse with no documented backup of the reporting configuration. What is the most appropriate next step?

  1. Approve the change because reporting services are always low risk
  2. Schedule the change and document the rollback afterwards
  3. Reject the change permanently without further discussion
  4. Require a documented rollback or recovery approach for the reporting configuration before authorisation Correct answer.

Explanation

A change should not be authorised until there is a viable way to recover if it fails, especially where configuration is undocumented. Requiring a rollback or recovery approach before authorisation addresses the gap while allowing the change to proceed.

Question 35Change management knowledge (up to SFIA level 3)

A change request specifies the technical steps but does not state the expected outcome or how success will be verified. Which action should the change manager take?

  1. Return the request for a defined success criterion and verification method before assessment Correct answer.
  2. Approve it and let the implementer decide what success means
  3. Convert it to a standard change to save time
  4. Escalate it directly to the CAB as an emergency change

Explanation

Without a stated outcome and verification method, neither the risk assessment nor the post-implementation review can be meaningful. The change manager should send it back for completion rather than guess at success criteria.

Question 36Change management knowledge (up to SFIA level 3)

A change is planned for a busy service and the implementer requests a period when the fewest users are active. Which scheduling consideration does this reflect?

  1. Maximising the number of users affected by the change
  2. Minimising business impact by selecting an appropriate implementation window Correct answer.
  3. Avoiding the need for authorisation
  4. Reducing the need to record the change

Explanation

Scheduling a change during low-usage periods reduces the number of users exposed to disruption if something goes wrong. This is a core scheduling consideration alongside resource availability and change collisions.

Question 37Change management knowledge (up to SFIA level 3)

A change to a payroll system is assessed as low impact but must comply with a statutory reporting deadline. How should the change authority treat the timing factor?

  1. Treat the deadline as irrelevant to prioritisation
  2. Delay it until after the deadline to reduce risk
  3. Deprioritise it because low impact always means low priority
  4. Prioritise it so it is implemented before the deadline while still completing required assessment Correct answer.

Explanation

Priority combines impact, urgency and business need, so a statutory deadline can raise priority even for a low-impact change. Assessment is still completed, but scheduling should respect the compliance date.

Question 38Change management knowledge (up to SFIA level 3)

A change is implemented successfully but a related service begins showing intermittent errors two days later. What should the change management process ensure happens?

  1. The change record is deleted to avoid confusion
  2. The implementer is automatically blamed without investigation
  3. The change is closed as successful and the errors are ignored
  4. The change is reviewed against the errors to establish whether it contributed and to trigger corrective action Correct answer.

Explanation

Post-implementation review should link observed issues back to the change so causation can be established and corrective action taken. Closing blindly or deleting records hides a possible regression and prevents learning.

Question 39Change management knowledge (up to SFIA level 3)

A change requires a database schema alteration that affects several applications. Which assessment activity is most important before authorisation?

  1. Identifying all dependent applications and confirming their compatibility with the schema change Correct answer.
  2. Estimating the marketing value of the change
  3. Confirming that only the primary application has been informed
  4. Checking whether the database administrator is on leave

Explanation

Schema changes ripple through every application that uses the affected tables, so dependency and compatibility analysis is essential. Informing only one application's team would leave other consumers exposed to failure.

Question 40Change management knowledge (up to SFIA level 3)

An organisation wants to measure whether its change management process is effective. Which metric is most directly relevant?

  1. The proportion of changes that caused incidents or required rollback Correct answer.
  2. The number of meetings held by the CAB
  3. The size of the change management team
  4. The total number of emails sent about changes

Explanation

Change effectiveness is best judged by outcomes such as the rate of failed changes, incidents caused and rollbacks. Activity counts like meetings or emails measure effort, not whether changes are being delivered safely.

Question 41Change management knowledge (up to SFIA level 3)

A change request is submitted with an owner but no indication of which configuration items will be modified. Why is this a problem for change management?

  1. Without the affected configuration items, impact and dependency assessment cannot be performed reliably Correct answer.
  2. It stops the change from being scheduled in any window
  3. It means the change cannot be classified as normal
  4. It prevents the change from receiving a unique identifier

Explanation

Configuration items are the link between a change and the infrastructure and services it touches, enabling impact and dependency analysis. Missing CI information leaves assessors unable to judge what else might be affected.

Question 42Change management knowledge (up to SFIA level 3)

What is the main benefit of integrating change management with configuration management?

  1. It eliminates the need for a change schedule
  2. It guarantees that no change will ever fail
  3. Accurate knowledge of affected configuration items improves impact assessment and record accuracy Correct answer.
  4. It removes the need for any authorisation step

Explanation

Configuration management supplies reliable information about components and their relationships, which sharpens impact analysis and keeps change records accurate. It supports control but cannot guarantee success or replace authorisation.

Question 43Change management knowledge (up to SFIA level 3)

A change implementer discovers mid-deployment that a step in the approved plan is wrong and a safer alternative exists. What is the best course of action?

  1. Improvise the alternative silently and finish the deployment
  2. Pause, seek authorisation for the revised approach, then proceed and update the record Correct answer.
  3. Abandon the change permanently without telling anyone
  4. Continue with the known-wrong step to stay within the approved plan

Explanation

Deviating from an approved plan changes the risk profile, so the revision should be authorised before proceeding and the record updated. Silent improvisation removes control, while blindly following a known-wrong step invites failure.

Question 44Change management knowledge (up to SFIA level 3)

Which practice best supports communication of upcoming changes to affected users?

  1. Announcing changes only after they have failed
  2. Publishing an accessible change calendar showing scheduled changes and their expected impact Correct answer.
  3. Relying on users to discover changes after they happen
  4. Restricting all change information to the implementer

Explanation

A visible change calendar lets users and support teams anticipate disruption and prepare. Communication after the fact, or restricting information, undermines the purpose of managing change openly.

Question 45Change management knowledge (up to SFIA level 3)

A change to a customer-facing portal is assessed as medium risk. The change authority is unsure whether to approve. What is the most appropriate action?

  1. Gather further information on impact and mitigation before making a decision Correct answer.
  2. Reject it because uncertainty always means rejection
  3. Approve immediately to avoid delaying the project
  4. Delegate the decision to the implementer without guidance

Explanation

When the risk picture is incomplete, the authority should obtain the missing impact and mitigation information rather than decide on guesswork. Premature approval or blanket rejection both ignore the available evidence.

Question 46Change management knowledge (up to SFIA level 3)

What does the term 'change enablement' emphasise compared with older 'change management' terminology?

  1. Preventing all change from occurring
  2. Enabling beneficial change to happen safely rather than acting mainly as a control gate Correct answer.
  3. Removing the need for any documentation
  4. Replacing technical teams with the CAB

Explanation

Change enablement reframes the practice as helping valuable change proceed safely, balancing speed with control. It does not mean blocking change or discarding documentation; it reorients the practice toward outcomes.

Question 47Change management knowledge (up to SFIA level 3)

A change is assessed as high risk and affects a regulated financial service. The change authority wants to reduce residual risk before approval. Which combination is most appropriate?

  1. A verbal assurance from the implementer that it will be fine
  2. A tested rollback plan, a pilot in a non-production environment and a defined communication plan Correct answer.
  3. Approval with no conditions and no monitoring
  4. Removal of the change from the schedule so it is invisible

Explanation

Residual risk is reduced through concrete controls such as tested rollback, controlled piloting and stakeholder communication. Verbal assurances and invisible scheduling provide no real risk reduction.

Question 48Change management knowledge (up to SFIA level 3)

An organisation finds that emergency changes are frequently raised for work that could have been planned. What is the most likely root cause and best response?

  1. Too much authorisation control; remove all approvals
  2. Overuse of standard changes; ban them entirely
  3. Weak forward planning and scheduling; improve change planning and horizon visibility Correct answer.
  4. Excessive documentation; delete change records

Explanation

When planned work is repeatedly forced through the emergency route, the usual cause is poor forward planning and limited visibility of upcoming work. Strengthening planning and scheduling reduces unnecessary emergencies rather than loosening controls.

Question 49Change management knowledge (up to SFIA level 3)

Two teams each propose a change to the same service in the same week, and neither is aware of the other. What is the most significant risk and the appropriate control?

  1. Excessive documentation; reduce the number of records
  2. Loss of ownership; assign both changes to a single implementer without review
  3. Duplicate authorisation; require both teams to use different identifiers
  4. Conflicting or compounding changes; use a shared change schedule and cross-team review to detect collisions Correct answer.

Explanation

Uncoordinated changes to the same service can conflict or compound risk, so a shared schedule and cross-team review are needed to detect collisions. The core problem is coordination, not documentation volume or identifiers.

Question 50Change management knowledge (up to SFIA level 3)

A change is technically successful but the business outcome it was meant to deliver is not achieved. How should the post-implementation review treat this?

  1. Ignore the outcome because only technical success matters
  2. Reopen the change as a failure and blame the implementer
  3. Close the change as fully successful because deployment worked
  4. Record the outcome gap and feed it back into future change justification and benefit planning Correct answer.

Explanation

Post-implementation review should assess whether the intended outcome was realised, not just whether deployment worked. Recording the gap informs future justification and benefit planning, improving how changes are proposed.