Does your change control process score change requester and/or implementers?

Question

Does your organisation have a change process, formalising every change, from whole new system deployments to cable patches?

If so does your process score those asking for changes or/and also those carrying out those changes based on how good they are? if so how's that working for you - any tips? if not do you think it would be a good idea?

We have a process but every change gets the same scrutiny no matter how small or how 'safe a pair of hands' the requester/implementer has been previously - I want to change this but thought it wise to see if you've ran into problems with this method.

Thanks.

Answer 1

We do have a CR process that everything must go through, but there is no scoring. There is levels of course - for example you indicate what the risks associated with the change are, and which environments could be affected by those risks - the environment might be something like "production Oracle DBs servicing Portal" for example.

If the CR states anything more than a minor - then the CR people have to have a big fat meeting.

As part of the CR, everyone needs to have a complete roll-back plan.

...But no, there is no scoring as such, other than the reputation you'll gain once they get to know you.

I think it's not a bad idea at all though, might put some incentive for people to do CRs, another reason why CRs are partly-useless here where I work specifically (imo) - is that you submit CRs, but don't have any means of querying them in a useful way, so again - less incentive.

The best way to make such things useful I think is to provide some value back to the people that you expect to use them. Either through functionality, or scoring (like serverfault), or other.

Answer 2

Having a change control process that has ways of circumventing additional scrutiny bypasses the main reason for a change control process in the first place. One of the benefits of getting people together to discuss changes is that you get more eyes and minds looking at potential changes. The more people (who preferably all work in different areas of your production infrastructure) you get looking at the problem, the more complete a picture you can get of the potential impacts.

While I think it's a neat idea to have a scoring system (possibly similar to the one on this site), even all-stars make mistakes/oversights. A tiny change in one place can have huge impacts in another.

Answer 3

This sort of scoring system sounds like it will be vulnerable to politics and gaming very quickly - indeed it sounds like you're trying to make it so the in-crowd get to circumvent change control. Whether that's a good idea or not I can't judge from this distance.

If you're going to bother with change control as a means of risk control, rather than CYA, then everything needs to have a risk and impact assesment. Who is carrying it out is not usually a factor in how risky something is - and even when it is, having a situation where some people are allowed to make changes despite being the unsafe pair of hands looks very odd.