Change Risk Assessment Questionnaire
Category Risk Assessment Question
As a change assignee &/ change approver, you are
1. Change Owner responsibility required to be familiar with all process
documentation.
2. Critical Services How are critical services impacted by this change?
How does this change alter the security model of
3. Security applications or platforms? (e.g. policies, access rights
BUSINESS IMPACT
etc.)
4. Consultation Have all involved or impacted business units, IT
services, and other stakeholders been consulted?
In case the change fails in the worst possible way,
5. Type of incidents in case of failure what type of incident would business/stakeholders
experience?
6. Workaround Is there a workaround if business functionality is
lost?
7. Maintenance window Is this change occurring during the weekend Maint.
Window?
How many other support teams are needed to
8. Number of touch points deploy this change (including SPCR, ISBC, Apps,
vendor and support teams)
9. Historical incidents How many High/Critical incidents due to changes in
your technology domain/platform [or application]
have occurred in the past 12 months?
FAILURE PROBABILITY
10. Size and complexity What is the size and complexity of a change to
determine the magnitude of impact?
# Internal Use
FAILURE PROBABILIT
11. Testing Who has performed testing, conducted an
independent review or examined the test results?
12. Service validation
How will all the involved services be validated for
functionality?
NOTE: Change Owner is responsible for Technical
validation. Functional validation can be performed by
Peer, BSA, Users or QM
13. Back out plan What strategy is in place should the change fail post
production validation?
Business Impact Score
13
# Internal Use
PRE-CHANGE RISK ASSESSMENT TOOL
Your Change Model
Answer Choice (Please choose from drop down) Minor Change
I accept responsibility.
`
No critical service involved
Unknown alteration
Everyone was consulted.
Incident level unknown
Reverse the change
Within the window and approved by users
My team and 1–3 other teams
No incidents
This is routine maintenance; low or no impact
# Internal Use
Business systems analyst
Full technical and functional validation
Backout is automated.
Failure Probability Score
10
# Internal Use
hange Model
Moderate Change Major Change
Change Risk
Failure
Probability
Moderate Risk High Risk High Risk
Likely
Low Risk Moderate Risk High Risk
Possible
Low Risk Low Risk Moderate Risk
Unlikely
Business
Low Medium High Impact
# Internal Use
# Internal Use
# Internal Use
