The ITIL Change Management Process, Step by Step
In short: The change management process controls changes to IT services, so that useful changes are made with as little disruption as possible. A change is requested, assessed, authorized, deployed, and reviewed. How much control a change needs depends on its risk. ITIL 4 calls the practice change enablement.
Last updated: November 2026
What Is the Change Management Process?
Every change to an IT service is a risk: a new release, a new server, or a changed firewall rule can cause an outage. The change management process makes sure that somebody has looked at the risk before the change is made, that the right people have agreed, and that there is a plan to go back.
This article is about changes to IT services as ITIL describes them. A change to the scope or the budget of a project is a different process, the change request. Both are in the list of 25 key business processes.
The Three Types of Change
| Type | What it is | How it is authorized |
|---|---|---|
| Standard change | Low risk, done often, with a known procedure, for example a password reset or a routine patch | Pre-authorized. No approval for each single change. |
| Normal change | Everything that is neither standard nor emergency | Assessed and authorized. Significant changes go to the change advisory board (CAB). |
| Emergency change | Has to be made at once, for example to fix a major incident or a security problem | A fast path with a small group of approvers. The documentation follows afterwards. |
The type decides the path through the process. Treating every change as a normal change is the most common reason why change management is seen as slow.
The Process as a BPMN Diagram
The template Change Management. Click the picture to enlarge it.
The Steps of the Change Management Process
- Log and review the request for change. The requester describes the change, the reason, and the affected services. The change manager checks that the request is complete.
- Assess the change. What is the risk, what is the impact, who is affected, and how can the change be reversed?
- Authorize the change. Depending on the type and the risk, the change manager or the change advisory board decides.
- Schedule and build. The change gets a date that does not collide with other changes, and it is built and tested.
- Deploy. The change is made in the agreed window.
- Review and close. Did the change do what it should, and were there incidents? The result is recorded and the change is closed.
Who Is Involved?
- Change requester: asks for the change.
- Change manager: owns the process, assesses changes, and authorizes changes of lower risk.
- Change advisory board (CAB): advises on significant changes. It usually includes operations, development, security, and the business.
- Implementers: build, test, and deploy the change.
- Stakeholders: the owners and users of the affected services.
Where Change Management Usually Gets Stuck
- One path for all changes. Standard changes wait for a meeting they do not need.
- The CAB meets once a week. A change that misses the meeting waits a week, whatever its risk.
- Changes are assessed without the people who run the service. The risk is underestimated.
- The review is skipped. Failed changes are fixed, but nobody learns from them.
Run the Change Management Process in Jira
Jira Service Management has a change work type and a workflow for it. A workflow describes the statuses of one work item. The process around it, with several teams, parallel assessments, and different paths by risk, can be modeled in BPMN with Flower:
- An exclusive gateway chooses the path by the type or the risk of the change. See BPMN Gateways.
- The CAB approval is an activity in its own swimlane, followed by a gateway on the decision. See Approvals with Flower BPM.
- Assessments by several teams run in parallel branches.
- A terminate end event stops all open tasks when a change is rejected or withdrawn. See BPMN End Events.
- The requester can start the process from a Jira Service Management portal. See Jira Service Management and BPMN.
For the background on ITIL and ITSM in Jira, see What Are ITSM and ITIL?.
Frequently Asked Questions
What are the steps of the change management process?
Log and review the request, assess, authorize, schedule and build, deploy, and review.
What are the three types of change in ITIL?
Standard changes, normal changes, and emergency changes.
What is a change advisory board (CAB)?
A group that advises the change manager on significant changes. It looks at risk, impact, and schedule.
What is the difference between change management and change enablement?
ITIL 4 renamed the practice from change management to change enablement. The goal is the same: make useful changes with as little disruption as possible.