By ITIL® from Experience©
First, let us review ITIL’s guidance to see if an incident is required in order to have an emergency change.
- The ITIL® Glossary defines an emergency change as "A change that must be introduced as soon as possible – for example, to resolve a major incident or implement a security patch."1 The need to have an incident in order to initiate an emergency change is not mentioned in the definition of an emergency change.
- Looking at the Release Management process, we find that an emergency release “Normally contain corrections to a small number of known errors, or sometimes an enhancement to meet a high-priority business requirement.”2 The source of this requirement whether it is from an incident or a service request is not specified.
- ITIL® Service Transition Section 18.104.22.168 on Emergency Changes states that: “The emergency change procedure is reserved for changes intended to repair an error in an IT service that is negatively impacting the business to a high degree. Changes intended to introduce immediately required business improvements are handled as normal changes, assessed as having the highest urgency." (2011 Edition, p. 82)
Based on this information it makes sense to limit the use of emergency changes to only resolving incidents3. Such a policy helps limit the number of emergency releases and thus, reduces the risk of causing more incidents due to a hastily executed change4.
However, emergency changes may be required for both incidents and service requests because of the approach used in your change management process. For example, at one organization all Request For Change (RFC) must be submitted two weeks prior to the Change Advisory Board (CAB) meeting. As a result people raise emergency changes to address pressing business requirements and operational issues that cannot wait 14 days for an approval. In this situation, limiting the use of emergency changes to only resolving incidents would result in:
- Unauthorized changes, or
- Escalation to management will approve it when the benefits of doing it outweigh the risks regardless if the change is to resolve of an incident or not.
The emergency change exists to address the needs of the organization when the normal change5 process cannot be followed. Each organization must determine the approach that best fits their situation and decide if an incident is required before an emergency changes is raised.
- How to reduce the number of emergency changes
- What level should the Change Manager position be to have the authority to reject RFCs
- What is a quick way to implement Change Management
- Is a reboot a change
- Should the incident be closed as soon as the RFC is logged
- How does it work when an incident requires a change
Copyright 2014 - ITIL® from Experience - D.Matte