Change Types, Change Models and Risk-Based Categorization
The three change types
Standard changes are low-risk, well understood, and pre-authorized by a change authority as part of a documented model - they are typically triggered by a service request and executed without further approval. Normal changes must be scheduled, assessed and authorized following a change model; they are commonly subdivided (for example minor and major) according to risk, impact and cost. Emergency changes must be introduced as quickly as possible, for example to resolve a major incident or close a security exposure; they follow a separate model with a defined emergency change authority and often reduced documentation that is completed retrospectively.
Change models and categorization
A change model describes the steps, roles, timescales and authorization route for a category of change. Categorization should be risk-based: likelihood of failure multiplied by potential impact, informed by the number of users and services affected, whether it is routine or novel, regulatory exposure and reversibility. Categorization is a decision made before the work, and it drives which model, which authority and which level of testing apply.
Traps
Common distractors: standard changes "do not need authorization" (they do - it is granted up front when the model is defined); every change needs a CAB (CAB is one optional form of change authority); emergency changes bypass assessment entirely (they do not - assessment is compressed, not eliminated); categorization is based on effort or cost alone. Another trap is assuming a standard change stays standard forever - models must be reviewed when failure rates or the environment change.
Worked example: a patch to a single internal reporting tool used by five staff, previously deployed twice with no incidents, is low likelihood and low impact - a good standard change. The same patch applied to the payroll database is high impact and possibly irreversible - a normal change requiring a documented assessment and senior authorization.