Your Change Management Data Template

Universal process mining template
Your Change Management Data Template

Your Change Management Data Template

Universal process mining template

This is our generic process mining data template for Change Management. Use our system-specific templates for more specific guidance.

Select a specific system
  • A standardized structure for your change management event log.
  • Recommended data fields and process steps for comprehensive analysis.
  • A foundation that is applicable across various IT service management systems.
New to event logs? Learn how to create a process mining event log.

Change Management Attributes

This table presents the recommended data fields and their definitions to include in your event log for comprehensive change management process analysis.
5 Required 8 Recommended 5 Optional
Name Description
Activity Name
ActivityName
The name of the specific business event, task, or status change that occurred within the change management process.
Description

The Activity Name describes a distinct step or milestone in the change request lifecycle, such as 'Risk Assessment Completed' or 'Change Approved'. Each activity represents a point in time where an action was taken, a decision was made, or the process moved to a new stage.

This attribute is fundamental for building the process map. It defines the nodes in the process graph, allowing analysts to visualize the sequence of events, identify common pathways, and detect deviations from the standard procedure. Analyzing activities helps uncover bottlenecks, rework loops, and inefficient handoffs between different stages of the change process.

Why it matters

It defines the steps in the process, enabling the visualization of the process flow and the analysis of bottlenecks, rework, and deviations.

Where to get

Usually located in an activity log, event history, or audit trail table associated with the change request.

Examples
Change Submitted For ReviewChange ApprovedImplementation StartedChange Closed
Change Request ID
ChangeRequestId
The unique system-generated identifier for a change request. This serves as the primary case identifier, grouping all related activities and events.
Description

The Change Request ID is a unique alphanumeric code assigned to each change request when it is created. It acts as the primary key for a single change case, linking all associated tasks, approvals, and logs from initiation to closure.

In process mining, this attribute is essential for reconstructing the end-to-end journey of each change. By grouping all events under a common Change Request ID, analysts can visualize process flows, calculate case durations, and analyze variations between different change lifecycles. It is the foundation upon which all case-level analysis is built, enabling a clear view of how individual changes progress through the system.

Why it matters

This ID is critical for tracking and correlating all events related to a single change, making it the cornerstone of process discovery and conformance checking.

Where to get

Typically found in the header or primary record of a change request transaction.

Examples
CHG0034501CRQ-10293789123ITSM-CHG-5501
Event Start Time
EventStartTime
The timestamp indicating the exact date and time when a specific activity or event began.
Description

The Event Start Time marks the beginning of an activity within the change request's lifecycle. This timestamp is crucial for sequencing events chronologically and for calculating the duration of activities and the overall case.

In process analysis, this attribute is used to order the activities correctly, forming the basis of the event log. It is essential for calculating all time-related metrics, such as cycle times between activities, waiting times, and total case duration. By analyzing these timestamps, organizations can identify which steps consume the most time and pinpoint opportunities for process acceleration.

Why it matters

This timestamp is essential for ordering events, discovering the process flow, and calculating all performance metrics like cycle times and waiting times.

Where to get

Found in the event log or audit trail for the change request. It may be named 'Creation Date', 'Start Date', or simply 'Timestamp'.

Examples
2023-10-26T09:00:00Z2023-10-26T14:22:10Z2023-10-27T11:05:00Z
Last Data Update
LastDataUpdate
The timestamp indicating when the data for this record was last refreshed or extracted from the source system.
Description

The Last Data Update timestamp specifies the last time a particular record was pulled from the source system. This is a metadata attribute that is essential for managing the data pipeline and ensuring the freshness of the analysis.

This attribute helps data engineers and analysts understand the timeliness of the data they are working with. It is used to monitor the health of the data extraction process and to confirm that the process mining analysis is based on recent and relevant information. It is generally not used for process analysis itself but is critical for data governance and reliability.

Why it matters

Ensures data freshness and helps in monitoring the health of the data pipeline, which is vital for the reliability of the process analysis.

Where to get

This timestamp is typically generated and added during the data extraction, transformation, and loading (ETL) process.

Examples
2024-05-20T12:00:00Z2024-05-20T12:05:10Z2024-05-20T12:10:00Z
Source System
SourceSystem
The name of the system or application from which the change management data was extracted.
Description

The Source System attribute identifies the origin of the event data. In environments with multiple ITSM tools or integrated systems, this field helps distinguish between data from different sources, ensuring data integrity and proper context.

While not always used in primary process flow analysis, it is invaluable for data validation and governance. It helps in troubleshooting data ingestion issues and can be used to compare process performance across different systems or business units if they use separate platforms. For example, a company might use one system for infrastructure changes and another for application changes.

Why it matters

Identifies the data's origin, which is crucial for data validation, troubleshooting, and analyzing processes that span multiple systems.

Where to get

This information may be stored as a field in the source data or added during the data extraction and transformation (ETL) process.

Examples
ServiceNowJira Service ManagementBMC Helix ITSMIvanti Cherwell
Affected Service
AffectedBusinessService
The primary business service or Configuration Item (CI) impacted by the change.
Description

The Affected Business Service identifies the core business capability, such as 'Email Service' or 'Online Banking', that the change will modify. This could also be a specific technical Configuration Item (CI), like a server or application, that supports a business service.

This attribute provides critical business context to the change management process. It allows analysis to be framed in terms of business impact rather than just IT activity. For example, analysts can identify which services are most frequently changed, which might indicate instability or a high rate of innovation. It also helps in prioritizing changes and assessing risk by linking technical changes to the business functions they support.

Why it matters

Links IT changes to business context, enabling analysis of which business services are most impacted by change activity and associated risks.

Where to get

Found in the change request's main record, often linked from a Configuration Management Database (CMDB).

Examples
Online BankingEmail ServiceSAP ERPSRV_WebApp01
Change Status
ChangeStatus
The current or final state of the change request within its lifecycle, such as 'In Progress', 'Awaiting Approval', or 'Closed'.
Description

The Change Status indicates the phase of a change request at a specific point in time or its final outcome. Statuses typically correspond to major milestones in the process and provide a high-level view of progress.

This attribute can be used in two ways. As a snapshot attribute, it shows the current state of all open changes, which is useful for operational dashboards tracking throughput and backlogs. As an event attribute, a change in status can itself be considered an activity, helping to enrich the event log if detailed activity data is sparse. Analyzing status transitions helps understand the lifecycle and identify where changes get stuck.

Why it matters

It provides a snapshot of the change's progress, enabling analysis of bottlenecks, throughput, and the current state of the change backlog.

Where to get

Found in the header record of the change request. Historical status changes may be found in an audit log.

Examples
NewAssessAuthorizeClosedRejected
Change Type
ChangeType
The classification of the change, such as Standard, Normal, or Emergency, which often dictates the process path it follows.
Description

The Change Type is a critical categorization that determines the required workflow, approval steps, and urgency of a change request. Standard changes are typically pre-approved and low-risk, Normal changes follow the full assessment and approval process, and Emergency changes require expedited handling due to an urgent business need.

Analyzing the process by Change Type is a core activity in change management analysis. It allows for comparing the performance and compliance of different change workflows. For instance, analysts can verify if Emergency changes truly follow a faster path or if Standard changes adhere to their simplified, pre-approved flow. This segmentation is key to understanding process variations and ensuring the right level of governance is applied.

Why it matters

This attribute is essential for segmenting analysis, as different change types have distinct, predefined process flows, approval requirements, and performance expectations.

Where to get

Located in the main record or header data for the change request.

Examples
StandardNormalEmergencyMajor
Event End Time
EventEndTime
The timestamp indicating the exact date and time when a specific activity or event was completed.
Description

The Event End Time marks the conclusion of an activity. Paired with the Event Start Time, it allows for the precise calculation of the processing time for each step in the change lifecycle.

This attribute is fundamental for performance analysis. The difference between the start and end times reveals the 'processing time' of an activity, while the time between one activity's end and the next one's start reveals the 'waiting time'. This distinction is key to identifying whether delays are caused by long tasks or by idle periods between tasks, guiding targeted improvement efforts.

Why it matters

It enables the calculation of precise activity durations, helping to distinguish between value-adding processing time and non-value-adding waiting time.

Where to get

Often found in the activity log or audit trail tables. If not available, it can sometimes be derived from the start time of the subsequent event.

Examples
2023-10-26T09:15:30Z2023-10-26T17:00:00Z2023-10-27T11:55:12Z
Priority
ChangePriority
The priority level assigned to the change request, typically derived from its impact and urgency.
Description

The Change Priority is a classification used to determine the relative importance of a change request. It helps teams schedule and allocate resources effectively, ensuring that the most critical changes are addressed first. Priority is often calculated based on the change's potential impact on the business and the urgency of its implementation.

In process mining, priority is a powerful dimension for filtering and comparison. Analysts can investigate whether high-priority changes are actually processed faster than low-priority ones. Any discrepancies could indicate issues with resource allocation, approval bottlenecks for critical changes, or inconsistent adherence to prioritization rules.

Why it matters

Allows for analyzing whether high-priority changes are processed faster than low-priority ones, validating the effectiveness of prioritization policies.

Where to get

Located in the main record or header data for the change request.

Examples
1 - Critical2 - High3 - Medium4 - Low
Responsible Team
ResponsibleTeam
The team, assignment group, or queue responsible for a change request or a specific activity within the process.
Description

The Responsible Team identifies the group of people assigned to work on the change at a particular stage. This could be an assessment team, an approval board like the CAB, or the technical team performing the implementation.

This attribute is essential for analyzing resource allocation, workload distribution, and handoffs between teams. A social network analysis can reveal communication patterns and bottlenecks between different groups. By measuring the time spent with each team, organizations can identify which groups are overloaded or where delays frequently occur during transfers of responsibility.

Why it matters

This is crucial for analyzing handoffs between teams, identifying resource bottlenecks, and understanding workload distribution across the organization.

Where to get

Found in the change request record or in the activity-level details. It may be called 'Assignment Group' or 'Team'.

Examples
CABNetwork EngineeringDatabase AdministratorsApplication Support Tier 2
Responsible User
ResponsibleUser
The individual user responsible for the change request or for completing a specific task.
Description

The Responsible User is the specific person assigned to a change request or activity. This attribute provides a more granular view of workload and responsibility than the team-level assignment.

Analyzing data at the user level can help in performance management and identifying training opportunities. It can highlight individuals who are process experts or those who may be struggling with certain tasks. It is also used to analyze rework, for instance, to see if changes handled by certain individuals are more likely to be rejected or require remediation. However, care must be taken to use this information constructively and not for punitive measures.

Why it matters

Provides a granular view for analyzing individual workload and performance, helping to identify experts and potential training needs within teams.

Where to get

Typically found in the change request record or in task-level details, often labeled as 'Assignee' or 'Assigned To'.

Examples
John Smithjane.doeServiceAccountUnassigned
Risk Level
RiskLevel
An assessment of the potential risk associated with implementing the change, such as 'Low', 'Medium', or 'High'.
Description

The Risk Level represents the assessed likelihood and potential negative impact of a change failing. This assessment influences the required level of testing, scrutiny, and approval. High-risk changes typically require a more rigorous review process compared to low-risk changes.

This attribute enables risk-based process analysis. It can be used to check if high-risk changes receive the appropriate level of review, such as review by a Change Advisory Board (CAB). It also allows for correlating risk level with outcomes, for example, to determine if high-risk changes have a higher failure rate, which might suggest the risk assessment or mitigation process needs improvement.

Why it matters

Enables analysis of whether process controls and approval workflows are correctly aligned with the assessed risk of the change.

Where to get

Found in the header data or risk assessment details of a change request.

Examples
HighMediumLowVery High
Change Reason
ChangeReason
The justification or business reason for proposing the change, explaining why it is necessary.
Description

The Change Reason is a textual description that outlines the business driver behind the change request. It answers the question 'Why are we doing this?', providing context such as 'Security patch for critical vulnerability' or 'New feature to improve customer experience'.

While often a free-text field, this attribute can provide valuable qualitative insights when categorized or analyzed with text mining techniques. It helps in understanding the demand for changes from different parts of the business. For example, analysis might reveal that a large percentage of changes are driven by bug fixes, indicating potential issues with software quality, while another period might show a high number of changes related to strategic projects.

Why it matters

Provides business context for why changes are being initiated, helping to analyze the main drivers of change within the organization.

Where to get

Typically found in the initial submission form or header details of the change request.

Examples
Urgent security patchingHardware lifecycle refreshNew feature implementation for Q4Resolve production incident INC012345
Impact
ChangeImpact
The assessed impact of the change on business services and IT infrastructure if it were to succeed or fail.
Description

The Change Impact measures the potential effect of a change on business operations, services, or infrastructure. It is a key input, along with urgency, for determining the overall priority of the change. For example, a change impacting a critical customer-facing service has a high impact.

Analyzing by impact helps to ensure that changes affecting critical services are managed with appropriate care. It can be used in conformance checking to verify that high-impact changes always go through specific approval or testing stages. It also allows for performance comparisons, such as checking if high-impact changes take longer to implement due to more extensive review and testing.

Why it matters

Helps verify that changes with a high business impact follow more rigorous review and testing paths, ensuring proper governance.

Where to get

Located in the main record or header data for the change request.

Examples
1-Extensive/Widespread2-Significant/Large3-Moderate/Limited4-Minor/Localized
Outcome Reason
ChangeOutcomeReason
A code or description explaining the final outcome of a closed change, such as the reason for rejection or cancellation.
Description

The Change Outcome Reason provides context for why a change request ended the way it did. For successful changes, it might be 'Successful'. For failed changes, it could be 'Unsuccessful - Rollback initiated'. For rejected or canceled changes, it gives the justification, such as 'Insufficient justification' or 'Canceled by requester'.

This attribute is crucial for root cause analysis of failed or rejected changes. By categorizing and analyzing these reasons, organizations can identify common failure patterns. For instance, if many changes are rejected for 'Incomplete information', it signals a need to improve the change submission process. This data helps in calculating and understanding KPIs like the Change Failure Rate and First-Pass Approval Rate.

Why it matters

Provides critical data for root cause analysis of failed, rejected, or canceled changes, helping to improve the quality of future change requests.

Where to get

Found in the closure details of a change request record. It may be named 'Close Code', 'Resolution', or 'Rejection Reason'.

Examples
SuccessfulUnsuccessfulRejected - Insufficient JustificationCanceled by userSuccessful with issues
Planned Completion Date
PlannedCompletionDate
The planned or target date by which the change implementation should be completed.
Description

The Planned Completion Date is the deadline set for the change, often determined by business requirements or Service Level Agreements (SLAs). It serves as a benchmark for measuring the timeliness and performance of the change management process.

This attribute is essential for SLA performance analysis. By comparing the actual completion date with the planned date, organizations can calculate the On-Time Completion Rate, a key performance indicator. Analyzing the changes that miss their planned dates can help identify the root causes of delays, whether they are related to approval bottlenecks, resource constraints, or unrealistic planning.

Why it matters

This is a key attribute for measuring SLA compliance and on-time delivery, helping to identify the root causes for delays in the process.

Where to get

Typically located in the header data of the change request.

Examples
2023-11-15T17:00:00Z2023-11-20T23:59:59Z2023-12-01T12:00:00Z
Urgency
ChangeUrgency
The urgency of the change, reflecting the time sensitivity of its implementation from a business perspective.
Description

The Change Urgency indicates how quickly a change needs to be implemented to meet business requirements. It reflects the time-criticality of the change, separate from its potential impact. A change might have low impact but high urgency, such as fixing a minor issue before a marketing campaign launches.

Urgency is a key component in calculating priority and is used to analyze the timeliness of the change management process. Analysts can investigate whether high-urgency changes are indeed processed more quickly. Comparing cycle times across different urgency levels can reveal if the process is responsive to business needs or if all changes are treated with the same speed, regardless of their time sensitivity.

Why it matters

Allows for analysis of process responsiveness to time-sensitive business needs by comparing cycle times across different urgency levels.

Where to get

Located in the main record or header data for the change request.

Examples
1-Critical2-High3-Medium4-Low
Required Recommended Optional

Change Management Activities

This section lists the essential process steps and milestones that you should capture in your data for accurate change management process discovery.
7 Recommended 7 Optional
Activity Description
Change Approved
A critical milestone where the change has been formally approved for implementation by all required parties. This event is captured when the final required approval is granted, often triggering a status change.
Why it matters

This is a key milestone for measuring approval efficiency and the first-pass approval rate. It separates the planning and assessment phase from the scheduling and implementation phase.

Where to get

Usually inferred from a status change to 'Approved' or a similar state. It can also be captured from the timestamp of the final approval record.

Capture

Capture the timestamp when the overall approval status of the change is set to 'Approved'.

Event type inferred
Change Awaiting Approval
Indicates the change request has passed initial reviews and is now formally pending a decision from an approver or a board. This activity is typically captured from a status change in the workflow, such as moving to 'Pending Approval'.
Why it matters

This status is critical for measuring approval cycle times and identifying bottlenecks in the decision-making process. High durations here often point to inefficient approval workflows or unavailable approvers.

Where to get

Inferred from a status change in the change record's history to a state like 'Awaiting Approval', 'Pending CAB', or 'Authorize'.

Capture

Identify status changes that signify the start of a formal approval waiting period.

Event type inferred
Change Closed
This marks the official successful completion of the change management process. This event is captured when the change ticket status is moved to its final 'Closed' state, indicating all work is complete.
Why it matters

As the primary successful end event, this activity is essential for calculating end-to-end cycle time. It signifies that the change has been fully processed and accepted.

Where to get

Captured from the final status change of the change record to a resolved state like 'Closed' or 'Done'.

Capture

Use the timestamp of the final status change to 'Closed'.

Event type inferred
Change Implemented
A key milestone indicating that the work associated with the change has been completed. This is typically captured via a status change to a state like 'Implemented' or 'Pending Verification'.
Why it matters

This milestone marks the end of the implementation phase and is crucial for measuring the actual implementation duration. It serves as the trigger for post-implementation activities like testing and review.

Where to get

Captured from a status change in the change record's history to a state signifying implementation completion.

Capture

Use the timestamp when the change record's status is updated to 'Implemented' or 'Completed'.

Event type inferred
Change Rejected
Represents the formal rejection of a change request by an approver, which halts the process. This is a terminal state for the request or may trigger a rework loop.
Why it matters

Tracking rejections is fundamental to calculating the change failure rate and identifying common reasons for denial. It highlights issues with change quality, planning, or justification.

Where to get

Captured from a status change in the change record's history to a state like 'Rejected' or 'Denied'.

Capture

Identify the timestamp when the change record's status is updated to 'Rejected'.

Event type inferred
Change Request Created
This activity marks the initial creation of a change request record in the system. It represents the official start of the change management process and is typically captured from the creation timestamp of the change record.
Why it matters

As the primary start event, this activity is essential for calculating the entire end-to-end cycle time of a change. It provides the baseline for measuring how long requests spend in the system.

Where to get

This event is almost always captured from the creation timestamp of the primary change request record or ticket.

Capture

Use the creation timestamp of the change request record.

Event type explicit
Change Scheduled
This activity marks the point where the approved change is officially scheduled with a defined implementation window. This is typically captured when planned start and end date fields are populated.
Why it matters

This milestone separates the planning phase from the execution phase. Analyzing the time between approval and scheduling can reveal backlogs or resource allocation issues.

Where to get

Inferred from the population or update of 'Planned Start Date' and 'Planned End Date' fields, or a status change to 'Scheduled'.

Capture

Use the timestamp when the change record's status becomes 'Scheduled' or when the planned date fields are set.

Event type inferred
Change Canceled
Represents the termination of a change request before its implementation or completion. This is an alternative end state, captured when the ticket status is set to 'Canceled' or 'Withdrawn'.
Why it matters

This is a terminal event that represents wasted effort. Analyzing the frequency and timing of cancellations helps identify process inefficiencies or changing business priorities.

Where to get

Captured from a status change of the change record to a terminal state like 'Canceled' or 'Withdrawn'.

Capture

Use the timestamp of the status change to 'Canceled'.

Event type inferred
Change Submitted For Review
Represents the formal submission of a newly created change request for initial evaluation or assessment. This is generally inferred when the status of the change moves from a 'Draft' or 'New' state to one indicating it is ready for review.
Why it matters

This activity helps identify the time spent in the initial data gathering phase before formal assessment begins. It can highlight delays in preparing a change for its first review gate.

Where to get

Typically inferred from a status change in the change request's history log, such as moving from 'New' to 'Assessing' or 'In Review'.

Capture

Identify status changes from a draft or new state to a review state.

Event type inferred
Implementation Plan Finalized
Signifies that all necessary planning for the change, including the implementation, testing, and backout plans, has been completed. This is usually inferred from a status change after approval or the completion of a planning task.
Why it matters

This activity measures the duration of the detailed planning phase. Delays here can impact the ability to schedule and execute changes in a timely manner.

Where to get

Often inferred from the completion of planning-specific tasks or a status update indicating planning is complete.

Capture

Look for the closure of planning tasks or a status change from 'Approved' to 'Scheduled'.

Event type inferred
Implementation Started
Marks the beginning of the technical execution of the approved change. This is typically captured by a status change from 'Scheduled' to 'In Progress' or 'Implementing'.
Why it matters

This activity provides visibility into the start of the actual change window. Comparing planned versus actual start times is key to analyzing schedule adherence.

Where to get

Inferred from a status change in the change record's history to an active state like 'In Progress' or 'Implementing'.

Capture

Identify the timestamp of the status change to 'In Progress'.

Event type inferred
Post-Implementation Review Done
Indicates the completion of the formal review that assesses the success of the change and captures lessons learned. This is typically captured by a status change or the closure of a review task.
Why it matters

This activity is crucial for continuous process improvement. Analyzing the time taken to complete PIRs can highlight commitment to learning from past changes.

Where to get

Inferred from a status change to a 'Review' state, the completion of a PIR task, or the addition of review notes post-implementation.

Capture

Identify the timestamp when a Post-Implementation Review task is closed or the status moves out of a 'Review' state.

Event type inferred
Post-Implementation Testing Done
Represents the completion of all required testing and validation activities to ensure the change was successful. This may be a distinct status or inferred from the closure of testing tasks.
Why it matters

Tracking the completion of testing helps measure the duration and effectiveness of the verification phase. It is a critical step before the change can be formally closed.

Where to get

Often inferred from the completion of associated testing tasks or a status change to a state like 'Verification Complete' or 'Testing Done'.

Capture

Look for the closure of verification tasks or a specific status update post-implementation.

Event type inferred
Risk Assessment Completed
This activity signifies the completion of the risk and impact analysis for the proposed change. It is often inferred when risk-related fields are populated or when a specific assessment task is marked as complete.
Why it matters

Analyzing the time taken for risk assessment helps identify bottlenecks in the early stages of the change process. It's crucial for understanding how quickly changes are prepared for formal approval.

Where to get

Inferred from status updates, completion of associated assessment tasks, or updates to specific risk and impact fields in the change record.

Capture

Look for the completion of a risk assessment task or a status change indicating the assessment phase is over.

Event type inferred
Recommended Optional

Extraction Guides

How to get your data for process mining.

Extraction methods vary by system. For detailed instructions,

read our ETL guide

or select a specific process and system.