Reduce risk by assessing a proposed change early, identifying who and what it affects, ranking the main risks, assigning mitigations and owners, and checking results as the change unfolds. “Change management” can mean guiding people through an organizational change or controlling changes to an IT system; both need risk assessment and monitoring, but the controls are not interchangeable.
What change-management risk means
For an organizational change—such as a new process, structure, or policy—risk includes whether affected people understand, accept, and can adopt the change, as well as whether the intended outcome is achieved. For an information-system change, risk includes security and operational consequences of altering a system or its configuration.
These perspectives can overlap. A system rollout may require both technical controls and staff preparation. Treat them as connected workstreams with appropriate owners rather than assuming a people-side plan replaces security review, or that technical approval ensures people will adopt a change.
Assess risks before and during the change
Risk assessment should be an early, maintained activity—not a one-time approval gate. NIST SP 800-30 Rev. 1 describes preparation, assessment, and maintenance for risk assessment in federal information systems and organizations. Published September 17, 2012, the guidance page showed an update on May 7, 2026; check its current status and applicability before adopting it as policy. It is not a general organizational change-management method.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
- Define the change. Record its intended outcome, boundaries, decision owner, affected roles or groups, systems, and dependencies.
- Examine the change and its context. Consider scope, complexity, timing, how many and which groups are affected, and dependencies. Review organizational attributes, previous change experience, and unresolved effects.
- Identify and rank risks. Consider both potential impact and how much influence or control the organization has over each risk. Include adoption and readiness risks for people-side changes; include security and operational effects for system changes.
- Assign a response. For each priority risk, document a mitigation, an accountable owner, an indicator or trigger to watch, and a review date. This is a practical working format, not a universal template prescribed by the cited guidance.
- Revisit the assessment. Check whether assumptions still hold as scope, dependencies, readiness, or system conditions change. Update mitigations when new evidence or effects emerge.
Prosci recommends assessing change characteristics and organizational attributes, ranking risks, planning mitigations, and consulting stakeholders. Its guidance is a vendor method, not a universal standard.
Reduce risks to adoption in organizational change
Even a technically sound or well-designed change can fall short if people are unprepared or leaders are not aligned. The ISO committee’s explanatory guide identifies leadership alignment, stakeholder engagement, communication, training, readiness and impact checks, and continuous improvement as components of change management.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
- Align leaders and decision-makers. Make sure leaders can explain the reason for the change, the desired outcome, and their role in supporting it.
- Engage affected stakeholders early. Ask what will change in their work, where friction or unintended effects may occur, and what support they need. Consultation is more than sending an announcement.
- Communicate the reason, plan, and timing repeatedly. Explain what will happen and when, make room for questions, and adjust communication to the audiences affected.
- Prepare people for their roles. Provide role-specific training and support before the change takes effect, especially where new tasks or responsibilities are involved.
- Check readiness and impact. Before rollout, look for gaps in understanding, capacity, skills, or resources. Afterward, monitor adoption and operational effects and adjust the plan where evidence shows problems.
Prosci reports that projects with “excellent change management” are 7X more likely to achieve project objectives. The overview page does not state the year or provide the underlying study details in the available passage, so treat this as vendor-reported association—not proof of causation or an estimate that applies to every organization. Lisa Kempton, Prosci’s Director of Global Learning Product Development, says that building readiness can be less effortful and more cost-effective than responding to resistance; this is expert commentary from the vendor, not independent comparative proof.
Apply explicit controls to IT and security changes
For an information-system change, use technical change control in addition to any people-side planning. NIST SP 800-171 Rev. 3 addresses protection of controlled unclassified information in nonfederal systems. Within that scope, it calls for defining controlled changes, reviewing proposals with explicit consideration of security impacts, approving or disapproving them, implementing and documenting approved changes, and monitoring and reviewing the activity.
- Set the change-control boundary. Define which systems and changes require formal control and who has decision authority.
- Review the proposal for security impact. Consider how the proposed change could affect the system and its security before authorizing implementation.
- Make an explicit decision. Record approval or disapproval rather than treating silence or informal discussion as authorization.
- Test and document approved work. Follow the organization’s applicable testing and implementation processes and record what was changed.
- Monitor the result. Review the changed system and change activity for effects that require correction or escalation through security and risk governance.
NIST SP 800-39 offers an organization-wide information-security risk-management perspective, but it is not a general method for managing organizational change. Neither NIST publication should be treated as policy outside its stated scope without checking applicability.
Choose a framework that fits the change
Frameworks can help structure work, but they address different problems. The ISO committee overview names Lewin’s unfreeze/move/refreeze model, McKinsey 7S, Kotter’s 8-Step Change Model, Prosci ADKAR, as well as ITIL, COBIT, and Agile frameworks. The overview does not establish a single model as the best risk-reduction choice, and these options are not all like-for-like.
Rank #4
| Option | Emphasis indicated by its name or category | Use it as a prompt to assess |
|---|---|---|
| Lewin’s unfreeze/move/refreeze | Stages of organizational change | Whether people and the organization are prepared for movement and how new practices will be sustained |
| McKinsey 7S | Organizational alignment | Whether the elements of the organization affected by the change remain aligned |
| Kotter’s 8-Step Change Model | Organizational change process | Whether leadership, communication, and sustained implementation are addressed |
| Prosci ADKAR | Individual adoption | Whether affected people are prepared and supported to adopt the change |
| ITIL, COBIT, and Agile frameworks | IT service, governance, or iterative delivery contexts, respectively | Whether technical/service governance and feedback fit the change’s delivery and risk profile |
Select by asking whether the change is centered on individuals, organizational alignment, or a system or service; how large and complex it is; which stakeholders and governance are required; and how readiness, adoption, technical impact, and outcomes will be monitored. The ISO committee page is an explanatory guide, not proof that ISO certifies the named programs; it says external certification bodies perform certification.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make risk reduction operational
A risk assessment is useful only if it shapes decisions and follow-up. Keep the risk owner, mitigation, indicator, and review date visible to the people responsible for the change. Connect people-side readiness checks with relevant rollout decisions, and route technical security concerns through the applicable security governance process. If monitoring shows that an assumption was wrong or a mitigation is not working, revise the plan rather than treating approval as the end of risk management.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
