Emergency change backlog: is more approval the right improvement?
A university's IT department supports 30,000 students. In the last quarter, 38% of changes were recorded as emergency changes, up from 12% a year earlier. The change manager approves most emergency changes by email after the fact; the CAB meets fortnightly but attendance is poor. A new student portal release was deployed on a Friday without a rollback plan; it failed and was rolled back manually after four hours. Configuration records for the portal's database were last updated three months ago. The service manager wants to “tighten the change process” by requiring more approvals, but project teams say this will slow delivery. The SMS scope includes change management and configuration management. An internal audit has raised a minor nonconformity for changes not being authorized before implementation. The university's semester starts in six weeks, and several faculty systems are due for upgrade.
1. Assess the situation against planning and operational control requirements. Is “more approvals” the right improvement? What should be done?
Read the worked answer
More approvals may worsen the problem by encouraging bypass. The pattern suggests that the change process is not planned and controlled: emergency changes are being used as the normal route, authorization is retrospective, CAB attendance is poor and release planning lacks rollback and configuration accuracy. ISO 20000-1 expects changes to be planned, risk-assessed, authorized, tested and reviewed, with emergency changes handled through a defined route and appropriate authorization. The service manager should first analyse why emergency changes rose-poor release planning, late requirements, capacity, testing, vendor dependencies-and then introduce standard pre-authorized changes for low-risk items, a fast but recorded emergency route, risk-based CAB criteria, release and rollback requirements, and configuration verification. Approval count is not the objective; controlled risk and predictability are.
2. What should the service manager measure to know whether the change process is improving, and how should this feed management review?
Read the worked answer
Use a small set of outcome and control measures: emergency changes as a proportion of all changes; unauthorized changes; change success rate; rollbacks and failed releases; lead time for normal changes; configuration record accuracy; CAB attendance and decision quality. Establish baselines and targets, and segment by service and change type so improvement is visible. Avoid measuring only approval volume, which can drive the wrong behaviour. Report trends to management review with interpretation: are emergency changes falling because planning improved, or because changes are being misclassified? Management review should decide resources, policy changes and actions, with owners and dates. The evidence should show that the change process is better controlled and that releases are more predictable before the semester starts, not merely that more signatures were collected.