ITIL Change Management
Unmanaged change is one of the biggest causes of avoidable outages. This ITIL Change Management SOP gives you a controlled path for every modification to a live environment — from a formal Request for Change through risk assessment, Change Advisory Board (CAB) approval, deployment, and a post-implementation review — so changes ship predictably instead of breaking production.
The workflow encodes the control logic that keeps change safe: pre-approved "standard" changes take a fast lane, while normal and emergency changes are routed through risk assessment and CAB sign-off. A rollback branch catches failed deployments, and the closing review gate sends any change that introduced new incidents straight into your incident process.
Import this template into Essoflo to adapt the change types and risk thresholds to your organisation, wire in your ITSM platform and CMDB, and assign the Change Requester, Change Manager, CAB, and Release Management roles to your team.
- Purpose
- Plan, authorise, and deploy changes to production with controlled risk, clear approval, and verified outcomes.
- Scope
- Applies to all standard, normal, and emergency changes to live IT services, from RFC submission through post-implementation review.
- Steps
- 11 steps & decisions
- Roles & tools
- Change Requester, Change Manager, CAB Members, Release Management TeamITSM Platform, CMDB, Risk Assessment Matrix, Deployment Tools
Step-by-step walkthrough
The same procedure as the diagram above, in reading order — decisions show where each answer leads.
- 1
Generate Request for Change
Submit a formal RFC detailing the scope, reason, and technical requirements of the change.
Who: Change Requester·Tools: ITSM Platform
- 2
Standard pre-approved change?
Pre-approved low-risk changes take the fast lane; normal and emergency changes need review.
True → Release & deploy to production·False → Risk assessment & impact analysis
Who: Change Manager·Tools: ITSM Platform
- 3
Risk assessment & impact analysis
Evaluate the change against the CMDB to detect systemic conflicts and quantify risk.
Who: Change Manager·Tools: CMDB, Risk Assessment Matrix
- 4
Risk acceptable & rollback ready?
Is the risk mitigated with a viable rollback plan?
True → CAB approves?·False → Reject & return for revision
Who: Change Manager·Tools: Risk Assessment Matrix
- 5
Reject & return for revision
Send the RFC back to the requester to address risk or rollback gaps.
Who: Change Manager·Tools: ITSM Platform
- 6
CAB approves?
Does the Change Advisory Board authorise the change?
True → Release & deploy to production·False → Change rejected / deferred
Who: CAB Members·Tools: ITSM Platform
- 7
Release & deploy to production
Release Management deploys the approved change into the production environment.
Who: Release Management Team·Tools: Deployment Tools
- 8
Deployment successful?
Did the deployment complete without a critical error?
True → Post-implementation review (PIR)·False → Execute automated rollback
Who: Release Management Team
- 9
Execute automated rollback
Roll back the deployment to the last stable state, then review what happened.
Who: Release Management Team·Tools: Deployment Tools
- 10
Post-implementation review (PIR)
Verify the change met its objectives without introducing secondary incidents.
Who: Change Manager·Tools: ITSM Platform
- 11
Outcomes met, no new incidents?
Did the change succeed cleanly?
True → RFC closed·False → Trigger Incident Management
Who: Change Manager
Related templates
ITIL Incident Management
Restore IT services fast: log and prioritise the incident, triage at L1, escalate to specialists when needed, and verify the fix with the user before closing.
ITData Backup & Recovery
Backups that actually restore: run the job, verify integrity, replicate offsite, and prove recovery works with scheduled restore drills.
HREmployee Onboarding
A repeatable first-week onboarding flow that gets new hires set up, trained, and productive — covering accounts, equipment, and role-specific training.
Prefer to start from scratch? Try the free RACI matrix builder or the onboarding program builder — no sign-up needed.