The IT Process Institute (ITPI) has teamed up with configuration audit and control software vendor Tripwire to identify best practices in change management. The two organisations surveyed 341 IT organisations while drawing up the white paper.

Whereas top performing IT groups in the survey controlled change, change controlled the poor performing IT groups, noted the white paper. The research found the top IT groups had deployed a closed-loop change management process to ensure no undocumented change escaped notice. Also, top IT groups pinpointed problems to enable weak areas to be improved, ensuring a continuously improving environment.

Paul Gostick, Tripwire’s Head of Europe, the Middle East and Africa, underscored the importance of a controlled approach to change. Tripwire’s white paper said that securing the right approach would mean that organisations perform better, face lower business risks, reduced security vulnerabilities and have less audit costs.

Although organisations adopt best practise change management policies to control change, such as the IT Infrastructure Library (ITIL), the white paper argues that such processes are not enough in themselves. "The policies must be enforced by a culture of change management that prevents unauthorised change", explained the white paper.

“Release management”, or the environment in which processes change, needs to be led from the top, with senior management inspecting processes to ensure change policies are followed, it adds.

Once employed, change policies need to be strictly adhered to, otherwise unexpected change will occur and administrators will roll out infrastructure into an environment unknown, said Gostick.

The top performing groups, while not perfect “are able to provide predictable, high-quality services in a cost-effective manner,” said the report. Such companies only spent 5 per cent of their time on unplanned work, compared to the bottom IT groups, which spent over 50 per cent of their time, the survey found.

The importance of maintaining a historical audit trail and limiting access to the production environment is also highlighted by the report, as is the value in testing change in a production environment, rather than a development environment.