(P-QU-15) The Risky Business of Change Control: Using Heat Maps to Identify Risk

Change control is used to ensure systematic management of processes and procedures in a controlled and coordinated manner. Our organization’s change control process was previously designed to fit location-specific models. As the organization grew, it expanded to include blood centers across five states. An increasing number of proposed changes were initiated with no direction for handling multiple competing priorities. Process standardization became imperative to minimize negative impact while other processes were streamlined. The purpose of this project was to evaluate how using a heat map to analyze risk facilitates risk mitigation and the overall change management process.

Study

Design/Methods:

Using risk assessment resources from NIST and ISO, a heat map was created to formalize risk level determination. The heat map factored in the severity of consequences with the probability of event occurrence to determine the overall risk of a proposed change. Risk was then classified as low, medium, or high based on the heat map, and mitigation of risk was required for medium- and high-risk changes.

Results/Findings:

A total of 190 organizational changes were proposed in 2022 which were not evaluated for risk using a heat map, and no mitigation strategies were required. The changes were tracked by departments with no clear pathway to prioritization or allocation of resources. As a result, some projects were stalled or canceled due to lack of resources. Others were rushed in execution, increasing the risk for error.

In 2023, a total of 337 changes were proposed: the first 73 changes used the previous method and 264 changes followed the revised process. They were evaluated for risk using the heat map, and 43 of these changes were identified as medium or high risk and required mitigation tasks. The most common mitigation tasks focused on communication, equipment, and training.

The change control process was more effective using the heat map because it systematically identified changes that could bring higher risk of potential hazards as well as changes that reduce or eliminate risk. This allowed the organization to prioritize which changes should be approved and executed to ensure resource allocation.

Conclusions:

Before implementation of the revised change control process, there was no way to identify which proposed changes were higher risk or should require mitigation. By streamlining the change control process with a focus on assessing risk with a heat map and implementing mitigation tasks for higher risk changes, proposed changes can be prioritized for execution, resource allocation, and support. This allows for smooth, coordinated, and controlled changes throughout the organization.