Example change management policy

1. Purpose

This policy ensures changes to IT services and supporting infrastructure are introduced in a controlled manner, balancing delivery speed with acceptable risk to service stability, security, and regulatory obligations.

2. Scope

This policy applies to all changes to production services, shared platforms, network infrastructure, applications, and configuration items under IT service management. It includes changes initiated by internal teams, suppliers, and automated deployment pipelines where those pipelines affect production.

3. Objectives

• maximise the number of successful changes to services and products
• ensure risks are assessed and authorization is obtained before implementation
• maintain an accurate and visible forward schedule of change
• enable emergency changes when delay would cause unacceptable harm
• capture learning through post-implementation review

4. Roles and responsibilities

• Change manager — owns the change practice, chairs or facilitates CAB, maintains the change schedule, and ensures records are complete.
• Change requester / implementer — submits accurate change records, implements approved work, and participates in review.
• Change authority — approves or rejects changes based on assessed risk; may be CAB, a delegated service owner, or automated for standard changes.
• Service owner — accountable for service risk tolerance and business impact of changes to their service.
• CAB — advises on normal and high-risk changes; ensures cross-team visibility and conflict avoidance.

5. Change classification

• Standard change — low risk, pre-authorized, documented procedure. No individual CAB approval required per occurrence.
• Normal change — requires assessment, scheduling, and authorization proportional to risk before implementation.
• Emergency change — implemented without prior CAB approval when delay would cause significant harm; retrospective review mandatory.

6. Authorization requirements

No change to production may proceed without documented authorization appropriate to its classification. High-risk changes require explicit CAB or senior change authority approval. Standard changes require adherence to an approved standard change procedure. Emergency changes require notification to the change manager as soon as practicable and CAB review within five working days of implementation.

7. Minimum change record content

• description of the change and reason for it
• services and configuration items affected
• risk and impact assessment
• implementation and rollback plans
• planned start and end times
• named implementer and approver
• test results or evidence of verification where applicable

8. Post-implementation review

Changes that fail, overrun, or cause incidents require post-implementation review within ten working days. Reviews identify root causes of failure, confirm whether authorization was appropriate, and feed actions to problem management and process improvement.

9. Compliance

Non-compliance with this policy — including unauthorized changes to production — may result in service restoration activity, disciplinary action under organisational HR policy, and mandatory review by the change manager and service owner.

Back to change management