Back to Assessments & Documents
IT Service Management Active

Change Management Maturity Assessment

A 63-question diagnostic across 8 domains that follows an IT change from governance, roles and enablement through request intake and classification, impact and risk assessment, planning, testing and back-out design, sche...

Start Assessment

Overview

A 63-question diagnostic across 8 domains that follows an IT change from governance, roles and enablement through request intake and classification, impact and risk assessment, planning, testing and back-out design, scheduling and authorization, implementation and verification, monitoring and control, and post-implementation review, measurement and learning. Written for the change manager or head of IT service management who needs to answer: does our change process protect service stability while letting the right changes through quickly, or is it a rubber stamp or a bottleneck?

Detailed Description

Change management exists to stop changes from causing incidents without slowing down the changes the business needs. Every outage, data loss or service degradation that traces back to a change is a failure of the process, and so is a change that waits weeks for approval it did not need. Many change processes drift toward one of two failures: a rubber stamp that approves everything, or a bottleneck that delays everything. This assessment looks at the whole change lifecycle. It starts with the policy, roles, change authority model, escalation, the people, skills and tooling the process runs on, and process interfaces, then examines how requests for change are captured, validated and classified, including standard and emergency changes. It covers how impact, risk, priority, dependencies and supplier involvement are assessed, how implementation, testing and back-out are planned and reviewed, and how changes are scheduled and the CAB and other change authorities accept residual risk and make, record and communicate decisions. It then looks at how changes are carried out, verified, backed out when they fail, closed and reflected in configuration records and documentation, how open changes, escalations, unauthorized changes and emergency access are controlled, and closes with how reviews, incident links, change KPIs, reporting and lessons improve later changes. Each question is scored on whether the practice is documented, implemented and effective, so the results show whether a gap is a missing standard, an adoption problem or a measurement problem, and which foundations to fix first. Service Transition, Release and Deployment (v5.9.6) is the companion model for service transition, release decisions, operational acceptance and early life support; DevOps Engineering (v1.9.6) covers automated pipelines.

Assessment Details

Audience

Change Manager / Head of IT Service Management / CAB Chair / Head of IT Operations. Secondary: service owners, release managers, configuration managers, IT risk and audit, service desk leads.

Purpose

Shows where the change process fails to prevent change-related incidents, where it delays low-risk changes without reducing risk, and where records, back-out and review are too weak to learn from failures. Gives each gap a concrete next step and a measurable target.

Effort

Initial assessment: 5-7 hours of facilitated sessions with the change manager, CAB chair, implementation team leads, service owners and the configuration and ITSM tool owners. Evidence gathering: 2 weeks (sample of change records by type and risk, CAB minutes, reviews and reports). Reassessment: 3-4 hours.

Cadence

Annually, and within 60 days of a change tool migration, a CAB or change authority redesign, or a rise in change-related incidents.

Framework Alignment

COBIT 2019 ITIL 4 ISO/IEC 20000-1:2018 ISO/IEC 27001:2022 NIST SP 800-53 Rev 5 ISO/IEC 42001:2023 NIST AI RMF 1.0 OWASP Top 10 for Agentic Applications 2026

KPIs

  • Change Success Rate - Share of implemented changes that meet their objectives without causing an incident or back-out. Target: 95% or higher.
  • Emergency Change Ratio - Share of all changes classified as emergency. Target: under 10%.
  • Back-Out Rate - Share of changes that required a back-out. Target: under 5%.
  • Standard Change Ratio - Share of changes executed as pre-authorized standard changes. Target: 40% or higher.
  • Unauthorized Change Rate - Share of detected changes without an approved request for change. Target: under 1%.

Dependencies

Configuration Management (v9.9.6): impact assessment, CI identification and post-change updates need accurate configuration records; drift detection reports unauthorized changes for this model to handle. Incident Management (v9.9.6) and Problem and Root Cause Management (v8.9.6): change-caused incidents and failed change root causes must flow back into change; both cite the Change Record Register this model owns. Service Level Agreements and Performance (v5.9.6): SLA impact assessment and change windows need defined and measured service levels. Service Availability Management (v6.9.6) and Technology Service Catalog (v10.9.6): cite the Change Windows and Blackout Agreement and the Standard Change Library this model owns; AI Governance (v11.9.6) owns AI policy and risk. Service Transition, Release and Deployment (v5.9.6) (companion): covers service transition, release planning, go/no-go, operational acceptance and early life support, which this model does not repeat. Build, test automation and deployment pipelines sit in DevOps Engineering (v1.9.6). Recommended: Run the Configuration Management assessment first, and the Service Transition, Release and Deployment (v5.9.6) assessment alongside this one where changes are delivered as releases.

Assessment Outline

(8 domains · 63 questions)
  1. 1

    1 Change Governance, Roles and Enablement

    Change management policy and process, change roles and responsibilities, change authority model, change escalation matrix, change role staffing, change training and competency, change process interfaces, change tooling, change process variants

    • 1.1 Change Management Policy and Process 1 questions
    • 1.2 Change Roles and Responsibilities 1 questions
    • 1.3 Change Authority Model 1 questions
    • 1.4 Change Escalation Matrix 1 questions
    • 1.5 Change Role Staffing 1 questions
    • 1.6 Change Training and Competency 1 questions
    • 1.7 Change Process Interfaces 1 questions
    • 1.8 Change Tooling 1 questions
    • 1.9 Change Process Variants 1 questions
  2. 2

    2 Change Request Intake and Classification

    RfC template, RfC completeness check, automated field validation, RfC status tracking, affected configuration items, change type classification, standard change models, emergency change procedure, changes to AI models, prompts and agents

    • 2.1 RfC Template 1 questions
    • 2.2 RfC Completeness Check 1 questions
    • 2.3 Automated Field Validation 1 questions
    • 2.4 RfC Status Tracking 1 questions
    • 2.5 Affected Configuration Items 1 questions
    • 2.6 Change Type Classification 1 questions
    • 2.7 Standard Change Models 1 questions
    • 2.8 Emergency Change Procedure 1 questions
    • 2.9 Changes to AI Models, Prompts and Agents 1 questions
  3. 3

    3 Change Impact and Risk Assessment

    Change impact assessment, change risk assessment, change prioritization and business justification, change dependency and conflict analysis, supplier and third-party changes, AI-assisted risk scoring

    • 3.1 Change Impact Assessment 1 questions
    • 3.2 Change Risk Assessment 1 questions
    • 3.3 Change Prioritization and Business Justification 1 questions
    • 3.4 Change Dependency and Conflict Analysis 1 questions
    • 3.5 Supplier and Third-Party Changes 1 questions
    • 3.6 AI-Assisted Change Risk Scoring 1 questions
  4. 4

    4 Change Planning, Testing and Remediation

    Implementation plan, change testing, back-out plan, back-out timing and point of no return, back-out testing, release and deployment plan review, technical review, implementation readiness and sign-off, change plan finalization

    • 4.1 Implementation Plan 1 questions
    • 4.2 Change Testing 1 questions
    • 4.3 Back-Out Plan 1 questions
    • 4.4 Back-Out Timing and Point of No Return 1 questions
    • 4.5 Back-Out Testing 1 questions
    • 4.6 Release and Deployment Plan Review 1 questions
    • 4.7 Technical Review 1 questions
    • 4.8 Implementation Readiness and Sign-Off 1 questions
    • 4.9 Change Plan Finalization 1 questions
  5. 5

    5 Change Scheduling and Authorization

    Change calendar, change windows and blackout periods, CAB operation, residual risk acceptance, approval records, conditional approvals, rejection handling, decision communication

    • 5.1 Change Calendar 1 questions
    • 5.2 Change Windows and Blackout Periods 1 questions
    • 5.3 CAB Operation 1 questions
    • 5.4 Residual Risk Acceptance 1 questions
    • 5.5 Approval Records 1 questions
    • 5.6 Conditional Approvals 1 questions
    • 5.7 Rejection Handling 1 questions
    • 5.8 Decision Communication 1 questions
  6. 6

    6 Change Implementation and Verification

    Execution to approved plan, implementation verification, deviation handling, back-out decision and notification, service restoration after back-out, back-out verification and escalation, change closure and outcome coding, configuration record update, documentation update and retention

    • 6.1 Execution to Approved Plan 1 questions
    • 6.2 Implementation Verification 1 questions
    • 6.3 Deviation Handling 1 questions
    • 6.4 Back-Out Decision and Notification 1 questions
    • 6.5 Service Restoration After Back-Out 1 questions
    • 6.6 Back-Out Verification and Escalation 1 questions
    • 6.7 Change Closure and Outcome Coding 1 questions
    • 6.8 Configuration Record Update 1 questions
    • 6.9 Change Documentation Update and Retention 1 questions
    • 6.10 Automated and Agent-Executed Changes 1 questions
  7. 7

    7 Change Monitoring, Escalation and Control

    Change progress monitoring, overdue change tracking, change escalation records, unauthorized change handling, emergency change access

    • 7.1 Change Progress Monitoring 1 questions
    • 7.2 Overdue Change Tracking 1 questions
    • 7.3 Escalation Records 1 questions
    • 7.4 Unauthorized Change Handling 1 questions
    • 7.5 Emergency Change Access 1 questions
  8. 8

    8 Post-Implementation Review, Measurement and Learning

    Post-implementation review, variance and exception records, failed change review, change-related incident linkage, change KPIs, change performance reporting and review, lessons learned

    • 8.1 Post-Implementation Review 1 questions
    • 8.2 Variance and Exception Records 1 questions
    • 8.3 Failed Change Review 1 questions
    • 8.4 Change-Related Incident Linkage 1 questions
    • 8.5 Change KPIs 1 questions
    • 8.6 Change Performance Reporting and Review 1 questions
    • 8.7 Lessons Learned 1 questions

At a Glance

Category IT Service Management
Type Free
Roles 5
Domains 8
Questions 63
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance