Change Impacts and Risks

ServiceNow Change Requests use a calculator to determine an overall Risk/Impact level based on 5 questions on the Risk Assessment tab. The answers are weighted and allow the Risk/Impact level to be standard across all changes. All fields on the Risk Assessment tab must be completed before the Risk/Impact level is computed allowing the Change Request to be sent for approval. The Risk/Impact is allows the CAB to concentrate on the highest two levels, 1 - Very High, 2 - High.

The Risk Assessment questions should be answered based on Risk/Impact during implementation of the Change as well as after the change is completed and take into consideration what would happen if the their were issues during the change.

The Risk Analysis field is another important part of the Change Request. This field describes specific impacts of doing the change are if it goes smoothly, has issues or ends in the worst case scenario. This includes

user impact after change (faster service, new form)
user impact(s) during change (speed degradation, system down, no outage expected)
impacts if the change fails (system will be down during restore)
recycle required
consider including prior issues as possible (missing certs may cause additional downtime, patch failing may requiring vendor support, addition firewall rules may be needed)

Note: Change Requests which will impact users require an associated Planned Outage on the Change Request. Even if, the Change will be implemented during a pre-defined Mainteancne Windows. A Planned Outage may not be needed if user's do not lose existing connections (SSH is not lost) nor if users can simply retry and have service respond (rolling recycle).

Risk/Impact	Description/RISKS
Level	Visibility	Potential Service Disruption	Technical Difficulty
1 - Very High	Highly visible to the affected customer(s) Changes being made during critical batch or production window (outside of maintenance window) Affects downstream applications	Could disrupt services to multiple schools and departments or disrupt key processing periods.	Installation of major new application or technology Requires a complete system recycle to install or back-out Difficult or impossible to back-out
2 - High	Highly visible to the affected customer(s) May affect downstream applications	Could disrupt services to a single school or multiple departments and a large number(s) of users.	Installation that involves two or more applications Requires application-level recycle to back-out Difficult to back-out
3 - Moderate	Low to moderate visibility to the affected customer(s) Minor impact if problems occur	Could disrupt services to two or more departments and/or small number(s) of users.	Two or more systems or applications are involved Does not require recycle to back-out Requires moderate effort to back-out
4 - Minor	No to low visibility to the affected customer(s) Minor impact if problems occur For Pre-Approved: Recurring, repeatable, documented procedure For Pre-Approved: Relatively low visibility to affected customer(s)	Could disrupt services to a single department and/or small number(s) of users For Pre-Approved: Known and documented impact; low risk of disruption to services	Single system or application is involved Does not require recycle to back-out Requires minor effort to back-out For Pre-Approved: Known and documented technical difficulty
5 - None	Only used in rare circumstances.

Notes:

Risk/Impact Excel Calculator : If you want to understand the Risk/Impact calculator, use this Excel workbook to see how adjusting your answers change the final level.
Answer Risk Assessment questions correctly: The Assessor (first approver on each Change) should review the risk questions to make sure they are are answered correctly. In most cases, when answered correctly, the ratings are appropriate.
Still need to talk about your change: In some cases Change Owners will still need talk about a Change even though it's not a Risk/Impact of "1 - Very High" or "2 - High", please send an email to the UIT Change Management group.