Skip to content Skip to site navigation

Change Impacts and Risks

ServiceNow Change Requests use a calculator to determine an overall Risk/Impact level based on 5 questions on the Risk Assessment tab. The answers are weighted and allow the Risk/Impact level to be standard across all changes.  All fields on the Risk Assessment tab must be completed before the Risk/Impact level is computed allowing the Change Request to be sent for approval.  The Risk/Impact is allows the CAB to concentrate on the highest two levels, 1 - Very High, 2 - High.

The Risk Assessment questions should be answered based on Risk/Impact during implementation of the Change as well as after the change is completed and take into consideration what would happen if the their were issues during the change. 

The Risk Analysis field is another important part of the Change Request.  This field describes specific impacts of doing the change are if it goes smoothly, has issues or ends in the worst case scenario.  This includes

  • user impact after change (faster service, new form)
  • user impact(s) during change (speed degradation, system down, no outage expected)
  • impacts if the change fails (system will be down during restore)
  • recycle required
  • consider including prior issues as possible (missing certs may cause additional downtime, patch failing may requiring vendor support, addition firewall rules may be needed)

Note: Change Requests which will impact users require an associated Planned Outage on the Change Request. Even if, the Change will be implemented during a pre-defined Mainteancne Windows. A Planned Outage may not be needed if user's do not lose existing connections (SSH is not lost) nor if users can simply retry and have service respond (rolling recycle).

Risk/Impact Description/RISKS
Level Visibility Potential Service
Disruption		 Technical
Difficulty
1 - Very High
  • Highly visible to the affected customer(s)
  • Changes being made during critical batch or production window (outside of maintenance window)
  • Affects downstream applications
  • Could disrupt services to multiple schools and departments or disrupt key processing periods.
  • Installation of major new application or technology
  • Requires a complete system recycle to install or back-out
  • Difficult or impossible to back-out
2 - High
  • Highly visible to the affected customer(s)
  • May affect downstream applications
  • Could disrupt services to a single school or multiple departments and a large number(s) of users.
  • Installation that involves two or more applications
  • Requires application-level recycle to back-out
  • Difficult to back-out
3 - Moderate
  • Low to moderate visibility to the affected customer(s)
  • Minor impact if problems occur
  • Could disrupt services to two or more departments and/or small number(s) of users.
  • Two or more systems or applications are involved
  • Does not require recycle to back-out
  • Requires moderate effort to back-out
4 - Minor
  • No to low visibility to the affected customer(s)
  • Minor impact if problems occur
  • For Pre-Approved: Recurring, repeatable, documented procedure
  • For Pre-Approved: Relatively low visibility to affected customer(s)
  • Could disrupt services to a single department and/or small number(s) of users
  • For Pre-Approved: Known and documented impact; low risk of disruption to services
  • Single system or application is involved
  • Does not require recycle to back-out
  • Requires minor effort to back-out
  • For Pre-Approved: Known and documented technical difficulty
5 - None Only used in rare circumstances.    

Notes:

  • Risk/Impact Excel Calculator : If you want to understand the Risk/Impact calculator, use this Excel workbook to see how adjusting your answers change the final level.
  • Answer Risk Assessment questions correctly:  The Assessor (first approver on each Change) should review the risk questions to make sure they are are answered correctly.  In most cases, when answered correctly, the ratings are appropriate. 
  • Still need to talk about your change: In some cases Change Owners will still need talk about a Change even though it's not a Risk/Impact of "1 - Very High" or "2 - High", please send an email to the UIT Change Management group.
Last modified February 21, 2017