Change scheduling based on business impact analysis of change-related risk

In today's enterprises, the alignment of IT service infrastructures to continuously changing business requirements is a key cost driver, all the more so as most severe service disruptions can be attributed to the introduction of changes into the IT service infrastructure. Change management is a disciplined process for introducing required changes with minimum business impact. Considering the number of business processes in an enterprise and the complexity of the dependency network of processes to invoked services, one of the most pressing problems in change management is the risk-aware prioritization and scheduling of vast numbers of service changes. In this paper we introduce a model for estimating the business impact of operational risk resulting from changes. We determine the business impact based on the number and types of business process instances affected by a change-related outage and quantify the business impact in terms of financial loss. The model takes into account the network of dependencies between processes and services, probabilistic change-related downtime, uncertainty in business process demand, and various infrastructural characteristics. Based on the analytical model, we derive decision models aimed at scheduling single or multiple correlated changes with the lowest expected business impact. The models are evaluated using simulations based on industry data.