System for Preparing IT Change Records for Risk Review

The problem

In day-to-day operations, change tickets, dependencies and maintenance windows arrive through different systems and event records, preventing the team from seeing the case on a single timeline.

As a result, source links can be lost while the impact scope and checklist are prepared, the case can be routed to the wrong team, and the basis for the technical decision can remain unclear.

An incomplete workflow may overlook a missing rollback plan or unclear dependency, while an incorrect system action could cause the change to disrupt the service.

What we set out to improve

• Time taken for the draft impact scope and checklist to be ready for specialist review
• Correct referral of records with no rollback plan or an unclear dependency to the appropriate specialist queue
• Record of recommendations corrected or rejected by the change manager

How the system works

1. 01 Retrieve change tickets, dependencies and maintenance windows from authorised sources
2. 02 Verify the source, timestamp and record identifier
3. 03 Add the relevant asset, user, shop, vehicle or content context
4. 04 Prepare a draft impact scope and checklist
5. 05 Compare the draft with technical rules and authority boundaries
6. 06 Check for exceptions: no rollback plan or an unclear dependency
7. 07 Obtain the change manager's approval, correction or rejection
8. 08 Write the input, recommendation, changes and final decision to the audit log

Methods we used

• Source- and time-traceable data extraction for change tickets, dependencies and maintenance windows
• Structured output that restricts the impact scope and checklist fields to technical rules
• An exception gate that separates cases with no rollback plan or an unclear dependency from system action
• An authorised queue that presents the evidence and recommendation together for the change manager
• Duplicate-processing controls and a rollback record to address the risk of the change disrupting the service

Where people stay involved

Data and security

Only fields required for the task are processed from change tickets, dependencies and maintenance windows. Source-system permissions are preserved, and unnecessary personal, technical and security-sensitive data is minimised before being sent to the model. Every retrieval, recommendation, human change and target-system action is written to the audit log.

Who this suits

Frequently asked questions