ITSM 101: Emergency Change and Why “No” is a Good Starting Point
If you’ve attended an ITIL Foundation course, you’ll remember learning about emergency changes, and the role of the ECAB – the emergency change advisory board. In many cases, the ECAB is presented as something of a “rubber stamp,” helping a change manager “cover their back” by getting an emergency action signed off by senior staff. What the relevant ITIL book (Service Transition) actually says is “Where CAB authorization is required, this will be provided by the emergency CAB (ECAB)” (do you think this would look good as a tattoo?).
Unfortunately though, there’s an absence of guidance explaining what’s expected from the members of an ECAB, or offering sensible approaches to take. It’s worrying, as organizations need to pay more attention to the role of the ECAB, as the decisions they make can have significant ramifications, even down to saving or dooming the company as a whole!
Caught Up in the Moment and the Drama
It’s all too easy to get caught up in the adrenaline rush when contacted about a proposed emergency change. Imagine the scenario: you’re woken up at 2am (although sometimes I’m out partying) by the operations team. They tell you that they have found a fault that will take down all your systems. But they know what to do – reroute some cabling, re-set some switches, a bit of emergency code, and all will be well within the hour. They just need you to sign it off and then they can save the day. What could possibly go wrong?
Well, in this specific scenario it might be clear why you would hesitate (lots of tweaks plus emergency code is scary), but in many less obvious situations the best answer might also be “No.” So much so, that it should be the default starting point for ECAB members. Emergency changes are always a risk, and the ECAB members need to be persuaded why they should commit the organization to taking that risk.
Help But Don’t Harm
The phrase “First do no harm” is associated with the Hippocratic oath and is just as applicable to emergency change as it is to medicine. A good starting question is “What happens if we don’t do it”. And this really means asking the question: “What happens to the business if we don’t do it” and so requires both technical and business input. It’s why the ECAB should include a business manager and a technical manager – both aspects matter and need to be considered together, and thus these two roles should already know each other reasonably well. In practice, it means that business relationship management (BRM) should play a part in setting up ECAB membership.
In real life, it’s surprising how often just asking the question, with it properly addressed, can stop the emergency from being a real emergency, and reduce the situation to “something to be dealt with urgently, but through safer channels.” Balancing the business damage caused by the effect of a fault against the potential damage of the cure is key to getting an ECAB to work right.
It’s perfectly possible to introduce a cure that’s worse than the disease it’s meant to cure, and a key ECAB role is to spot and prevent that.
Take the Right Amount of Time to Decide
Albert Einstein is believed to have said:
“If I had only one hour to save the world, I would spend fifty-five minutes defining the problem, and only five minutes finding the solution”.
The equivalent of Einstein’s point for an ECAB is to first establish, as a priority, when a decision must be made, and take maximum possible advantage of that time for their decision making. This means understanding:
- Not only what damage the emergency could cause, but when that would happen
- The absolute latest time that a potential emergency repair solution would have to be started in order to prevent damage
- What relevant research, analysis, and opinion gathering is possible in the established “decision window”
Done well, this makes best use of all the time, instead of rushing into a solution that might cost the organization dearly if it doesn’t go to plan.
Much of What’s Needed is Communication
The above points are just a few of the aspects that should be explained to ECAB members and form part of a training session before they need to fill the role for real.
The key message is that ECAB membership isn’t something to just casually assign to randomly chosen managers. Don’t just add it to someone’s job responsibilities and presume they will know how to do it well. Take the role seriously, select those who will do it well, train them, and test them through simulations and practice.
In short: everyone involved needs to take the evaluation and authorization of emergency change seriously. Your business might just depend on this.
Do you have emergency change guidance or good practice to share? I’d love to hear it (as would many others no doubt).
