Change Risk Assessment

[punitchourey]

Hi All,

we have created two Change Assessment:

1. Impact

2. Risk.

In new state when change is submitted, user clicks on Fill Out Risk Assessment. It shows Impact Assessment questions. User fills out them and submit. He then clicks on Execute Impact Calculation to calculate the scores.   In Risk Assessment Tab(Related List), responses for Impact Assessment is shown. He then moves the change to Assess state. He then clicks on Fill out Risk Assessment. It shows Risk Assessment questions. He then clicks on Execute Risk Calculation. In Risk Assessment Tab(Related List), responses for Risk Assessment is shown.

Issue: When user clicks on Execute Risk calculation UI action, it always shows the sys_id of Impact Assessment,instead of Risk Assessment and hence does not calculate the scores. But if we delete the Impact Assessment response from the Risk Assessment task and then Fill Out Risk Assessment and then click on Execute Risk Calculation, it is working fine.

Please let me know if anyone has fixed it or have any suggestions to fix this.

Note: Fill Out Risk Assessment and Execute Risk calculation are Out Of Box(OOB),

Thanks in advance.

Punit Chourey

[mike_bush]

I think the out-of-box actions for "Fill Out Risk Assessment" and "Execute Risk calculation" are expecting to be run ONCE ONLY. It sounds as if you have introduced confusion by adding your "Impact" equivalents. You will have to be prepared to "enhance" the out-of-box functions to allow them to distinguish the "Impact" questions from the "Risk" (or simplify it all back down to one "Impact and Risk" combined action?)

[Jeff Boltz1]

If this is the out of the box implementation, then there is an imperfect understanding of what the definition of risk is.   Impact and Risk are not two separate measures since risk is composed of likelihood (probability) and severity (impact) based on objectively sourced information.

We have all probably seen the itSMF statement to the effect of 80% of all incidents are caused by change, but what are the true measures?

If we were to test the association and dependence between changes and incidents, we would likely see a strong positive correlation between changes and incidents.

The question, is how do we delineate among the pool of changes to see what is high, medium or low risk?

The key is to identify variations among change records - which ones are likely to cause and incident and what would be the impact depending on the affected CI?

There is often an high degree of collinearity among the change feature set, and finding variation is difficult.   That's where dimension reduction comes in, such as principal components analysis which creates new component variables.

These new variables can be used in clustering, such as k-means to find similar within and dissimilar across sub-sets of changes that can be correlated to incidents by CI.

I used 3 clusters corresponding to high, medium and low risk, and then used those segments to check association and dependence to the rate of incidents.   I consistently found that the correlation coefficient was high, medium, low (e.g. r=.9734, .65743, .3458) meaning that high risk clusters could be identified.

Using this knowledge on the forward schedule of change, we can identify, then take action on the high risk clusters by empowering CAB meetings, Change Oversight, etc. with recommendations to perform more testing, move the change out, or even defer the change.

The last part is to show action-attributable incrementality, in other words did taking action actually reduce the occurrence of incidents.   Still working on measures of lift for that one, maybe a targeted experiment on "treated changes" vs "untreated changes"?