Change Management

PURPOSE

The objective of this Standard Operating Procedure (SOP) is to establish a systematic approach to managing changes within HIC. This SOP outlines the processes and responsibilities for identifying, assessing, approving, implementing, and reviewing changes to ensure they are effectively managed while minimising risks and disruptions to operations.

SCOPE

This SOP applies to all departments and personnel involved in initiating, evaluating, and implementing changes within HIC. This document provides a summary of each of the main sections of the change management process as is implemented by HIC. This document does not cover test or development work unless there is an impact on production or pre-production areas.

RESPONSIBILITIES

PRINCIPLES

1. Every change identified, either from external input or from an internal party, will go through a documented process. 

PROCEDURE

1. Request for Change (RFC) Initiation

• The Change Reporter completes a Standard or Non-Standard Change Management Ticket providing details such as the nature of the change, its purpose, scope, and potential impact.

• A Standard Change is defined as a documented process for change which has been reviewed and pre-approved by the CAG.

• Supporting documentation, such as risk assessments, cost estimates, and stakeholder analyses, may be attached to the change management ticket.

2. Change Validation

• A Standard or Non-Standard Change is validated by the Change Sponsor.

• Validation is the process of ensuring that the party requesting the change is indeed authorised to request it and that the request is appropriate.

• Change Requestor and Change Sponsor ensures the following are in place;  

  • Identifying the priority and category of change.

  • Identifying the stakeholders and related communication plan. 

  • Identifying the urgency and impact of the change. 

  • Identifying the assets affected by the change. 

  • Identifying the risks of making the change. 

  • Creating an Implementation Plan 

  • Creating a Test Plan. 

  • Creating a Roll-back plan.

• If necessary, the proposed change could be prototyped to gather as much information as possible 

3. Change Approval 

• A Risk Assessment Score is automatically calculated using the Risk Assessment Consequences/Likelihood assessment.

• Based on this assessment the following paths are available:

  • Standard Change

    • 1-8 → within Risk Appetite and does not require approval by CAG

    • 9-19 → requires CAG approval

    • 20+ → change is not approved as it is outside our risk appetite

  • Non-Standard Change

    • 1-8 → requires CAG approval

    • 9-19 → requires CAG approval

    • 20+ → change is not approved as it is outside our risk appetite

4. Change Implementation

• The Change Implementer develops a detailed change implementation plan, including tasks, timelines, resource requirements, and communication strategies.

  • Change Implementation – Following the approved implementation plan, in the event of a failure, the roll-back plan will be implemented or an Incident raised.

  • Change Testing – Following the approved test plan. 

  • Post Implementation Review – The change will be verified and reviewed with any issues logged on the ticket. 

  • Standard Change Creation – If applicable a standard change will be created to streamline future change requests. This will be reviewed by the CAG prior to availability for use. 

5. Change Communication

• Change Implementer follows communication plan and stakeholders are kept aware of change status.

6. Documentation and Record Keeping

• The process will be documented and stored within the Project Management system.  

  • If applicable, relevant documentation will be created or updated by the staff responsible. 

  • This process is parallel to the Change Workflow and does not necessarily finish when the Change Workflow ends.  

  • This may involve, but is not limited to, training for staff and instructions/guidelines to users. 

APPLICABLE REFERENCES

• Standard Change Processes

• How to Co-ordinate Change Management CAG Process

• How To Create a New Standard Change

• For Definitions see ISMS Glossary

DOCUMENT CONTROLS