The SANS Technology Institute

Operations Laboratory

The Importance of Accountability in Establishing Change Management

March 19th, 2007
By Lorna Hutcheson

Why the Need for Accountability in Change Management

Having an effective change management process within an organization will have a positive impact on that organization with respect to both the business aspect and the employee performance aspect. In order to have a successful change management process you have to have accountability. An example case study on implementing change management within large organizations stated this fact: "Senior management realized that, for the long-term survival and prosperity of the company, it would be necessary to have empowered workers who were capable of, and responsible for, making their own decisions."¹ Keep in mind that responsibility is the understanding that something is yours to complete while accountability is the actual taking ownership of your responsibility.² This is the essence of accountability; being held accountable for your actions.

Without accountability, the change management process is doomed to failure. It becomes nothing more than a paperwork drill, with no incentive for personnel to follow the process. It just becomes another checkmark for auditing purposes. Without accountability, you won't reap the benefits of all the time and effort spent in trying to implement change management. All the manpower and time spent designing, implementing and documenting will be lost if everyone can just bypass the system.

As an example, in the book entitled The Visible OPS Handbook you find the story of Jackie Shaffer, who was responsible for implementing change management within the state agency she was working for. She tells how, after implementing change management, within the first 30 days there were 200 IT changes, the next 30 days only 100 changes and the next 30 days only 80 changes. It sounds great doesn't it? You implement change management and the workload decreases. Well, not actually, because what Jackie found was even though the numbers were decreasing, the workload was exactly the same and there was no decrease in the number of outages or unplanned work. How could this be? Well, Jackie decided to implement controls to detect changes. What she found was startling, the number of changes was really going up. People were simply bypassing the system.³

Two Critical Parts to Accountability

This story very clearly illustrates the importance of accountability when implementing change management. Based on this, there are two important aspects of accountability in support of change management. First is that monitoring of changes is critical to the success of the organization and second is that some sort of action has to be taken when unauthorized changes are made. Without these two critical items, which are essential to accountability, it will be very difficult to establish a culture of change management.

Monitoring for Changes
The Military Intelligence community has a great slogan which simply states: "In God we trust, all others we monitor." Many people take offense to the concept of being "monitored" because in their eyes it carries the implication that you are not trusted. That could not be further from the truth. Monitoring is really just verifying the process is working as it should. Verification controls are not established to determine who you can or cannot trust, but rather to verify and enforce the process in order to increase performance. It keeps the progress the organization is making from sliding backwards.³ Knowing that someone is watching most often modifies people's actions and their thought process. It tends to make them more careful and more apt to follow the rules. As a result of monitoring for changes, the number of unplanned changes decreases and your organization's performance increases.

Repercussions for Failure to Comply
The second critical piece of enforcing accountability is to ensure there are repercussions when the process is not followed. Repercussions for non-compliance do not have to be punitive. A good repercussion could just be to remove their authority or administrative access or possibly assign additional duties such as having to stay late (or come back in) to perform security checks for the IT department area. These checks could include such items as ensuring the safes/file cabinets are all locked, doors secured, systems locked, backup media secured etc. Of course, repeat occurrences need to be moved toward more punitive actions being taken if they refuse to adhere to the process. Everyone has to understand that failure to comply with the change management process will not be tolerated.

Summary

"The key to creating a successful culture of change management is accountability."³ The entire organization needs to understand the need for being accountable. That will happen as employees start to see the benefits of having the process done correctly. There will be less unplanned outages and work. They will begin to move from the reactive mode of operation to being proactive. When this happens, the employees will start to police their own ranks and eliminate subversive behavior before it ever happens. Change management is often cited as the single most important factor for success even above the actual business solution.⁴ Because of the importance placed on it being done right, it makes it all the more critical to ensure accountability is in place as well. Without accountability, change management will fail.



All links were working at the time this article was created. If a link goes away, we retain the link in the list as it may be the only remaining source for this information.


¹ http://alumnus.caltech.edu/~rouda/T5_LSRTOD.html
² http://www.managingchange.biz/change_management_training.html#change_workshop_three
³ http://www.tripwire.com/resources/articles/index.cfm?aid=5
⁴ http://www.change-management.com/tutorial-value-systems.htm