Risk
Every normal and emergency change has a risk: Low, Medium or High. The risk decides which plans the change needs before it can be sent for approval, and approval policies can use it to decide who approves (Approvals). Standard changes are low risk by definition and have no risk questions.
Answer the questions → The highest answer sets the risk → The rules can raise it → Plans and approvers follow
How the answers make a risk
Each answer to a risk question is marked Low, Medium or High. A change's risk is worked out in three steps:
- The highest answer sets the risk. One High answer makes the change High; otherwise one Medium answer makes it Medium. A question not answered yet counts as Low.
- Medium answers add up. By default, two or more Medium answers make it High.
- A tier 1 service raises it one step. Low becomes Medium, and Medium becomes High.
Change Management → Settings → Risk can change the number of Medium answers or turn that rule off, and can turn off the tier 1 rule.
The questions a new organization starts with:
| Question | Low | Medium | High |
|---|---|---|---|
| Has this been done before, the same way? | Yes, often; once or twice | Never | |
| Can it be backed out within the window? | Yes, quickly | Yes, but it takes time | No |
| Will customers notice? | No; some of them, briefly | Yes, all of them | |
| Has it been tested? | Yes, in a test environment; partly | No |
On a change
The Risk section shows the risk with one sentence saying why, such as High because "Can it be backed out within the window?" is No, or Low: no answer raises it; Customer VPN is tier 1, which raises it to Medium. Under it is what that risk means and the plans it needs. Below that are the questions, each with a short note on what to think about. Every answer is one click away, and the chosen answer shows its level when that level is Medium or High.
Changing an answer works the risk out again straight away. On a change waiting for approval or already approved, it makes a new version, and the approvers are asked again (What gets approved).
Setting the risk by hand
When the questions miss something about a change, its owner or a Change Manager can choose Set by hand… and pick another risk, saying why. The section then shows the risk set by hand, the risk the answers make and the reason. A risk set lower than the answers make is listed in the exceptions report, and the reason is in the change's evidence. Choosing From the answers goes back to the risk the answers make.
When the questions or rules change
A change keeps the risk it was assessed with. Editing the questions or rules in Settings doesn't change the risk of existing changes, so approvals and their evidence stay as they were. If today's questions and rules would give a different risk, the change says so. Editing one of its answers works the risk out again under today's settings.
Setting up risk
Change Management → Settings → Risk has three parts:
| Part | What you set |
|---|---|
| How the risk is set | The highest answer always sets the risk. You can also make enough Medium answers add up to High (2 to 5, or off), and have a tier 1 service raise it one step (on or off). |
| Questions | Each question with what to think about when answering, and its answers, each marked Low, Medium or High. Add question and Edit open the question; the arrows change the order changes show them in. |
| What each risk asks for | What each risk means, and the plans normal and emergency changes at that risk need before they can be sent for approval. Who approves is set by the approval policies. |
Removing a question or an answer doesn't change existing changes: they keep their answers and their risk. Every change to these settings is kept in the control history (Settings → History).
Good questions are about what makes a change go wrong: whether it can be undone, whether it has been tested, how many customers it touches, and whether anyone has done it before. Mark an answer High only when that answer alone should need every plan and the strictest approval.