= Change management is the process of planning, implementing, and monitoring changes to IT systems, services, or infrastructure in a controlled and coordinated manner1. Change management controls are the policies, procedures, and tools that ensure changes are authorized, documented, tested, and reviewed before they are deployed to the production environment2.

Change-related exceptions are the deviations or violations from the established change management controls, such as unauthorized, untested, or failed changes3. Change-related exceptions pose a high risk to theorganization, as they can cause system instability, performance degradation, security breaches, data loss, or compliance issues3.

An increase in change-related exceptions per month would be the greatest concern for an IT risk practitioner, as it indicates a lack of effectiveness, efficiency, or compliance of the change management process and controls. An increase in change-related exceptions per month could result from:

Poor change planning, prioritization, or scheduling

Insufficient change approval, review, or communication

Inadequate change testing, validation, or verification

Lack of change monitoring, reporting, or auditing

Low change awareness, training, or support

An IT risk practitioner should investigate the root causes of the increase in change-related exceptions per month, and recommend corrective and preventive actions to improve the change management process and controls, such as:

Aligning the change management process with the organization’s goals, strategies, and risk appetite

Implementing a standardized and consistent change management methodology, such as ITIL or COBIT

Defining clear roles and responsibilities for change management stakeholders, such as change owners, change managers, change advisory boards, change implementers, and change users

Establishing clear and measurable criteria and thresholds for change authorization, classification, and evaluation

Leveraging tools and technologies to automate and streamline the change management process and controls, such as change management software, configuration management databases, or change management dashboards

Enhancing the change management culture and capabilities, such as change management awareness, training, support, or feedback

The other options are not as concerning as an increase in change-related exceptions per month, because they do not directly imply a risk to the organization’s IT systems, services, or infrastructure. Rolled backchanges below management’s thresholds, which are the changes that are reversed or undone due to errors, defects, or issues, may indicate a need for improvement in the change testing, validation, or verification processes, but they do not necessarily cause harm or damage to the production environment, as long as they are within the acceptable limits set bythe management. The average implementation time for changes, which is the duration of the change deployment process, may affect the organization’s agility, efficiency, or productivity, but it does not necessarily compromise the quality, security, or reliability of the changes, as long as they are implemented according to the change management controls. The number of user stories approved for implementation, which are the requirements or features that are expressed from the perspective of the end users, may reflect the organization’s demand, innovation, or customer satisfaction, but it does not necessarily increase the risk of the changes, as long as they are managed and controlled by the change management process.

References = What is Change Management? | ITIL | AXELOS, Change Management Controls: Definition, Types, and Best Practices, Change Management Exceptions: Definition, Causes, and Impacts, ITIL Change Management: Best Practices & Processes - BMC Software, COBIT 2019: Change Enablement