Change Impact Scorer (COBIT BAI06)

Overview

Draft change enablement and risk impact: pre-approved/standard change list using a weighted risk matrix. Ensures Emergency Changes require PIR. Includes emergency change logic check.

Example Conversation

You: We’re documenting our change process — standard, normal, and emergency. I want to make sure every emergency change still requires a Post-Implementation Review.

Agent: I’ll draft the change policy with change types, risk matrix, and approval paths, and explicitly require a PIR for emergency changes, then run emergency_change_logic.

Agent: Created change-policy-bai06.md. Running emergency_change_logic…

Agent: FAIL — emergency change is mentioned but there’s no Post-Implementation Review (PIR) requirement. I’ve added: “All emergency changes must have a mandatory Post-Implementation Review within 5 business days.” Re-running…

Agent: PASS — Emergency changes now have a documented PIR requirement. The policy is ready for CAB sign-off.

What the Tools Validate

emergency_change_logic scans the change policy or process document (Markdown or text):

• Detection: Looks for mentions of “emergency change”, “expedited change”, or “change type: emergency”.
• Rule: If emergency change is mentioned, the document must also state a requirement for Post-Implementation Review (PIR) (e.g. “PIR required”, “post-implementation review”, “review after emergency change”).
• Output: PASS if there is no emergency process or if a PIR requirement is documented; FAIL if emergency changes are mentioned without a PIR requirement. Add the requirement and re-run (BAI06).

Output Excerpt

Change policy (excerpt):

## Change types (BAI06)

- **Standard:** Pre-approved; low risk; no CAB. Execute per runbook.
- **Normal:** Risk-assessed; CAB approval above threshold.
- **Emergency:** Expedited for critical incidents. **All emergency changes require a Post-Implementation Review (PIR) within 5 business days** to capture lessons and update controls.

emergency_change_logic report (excerpt):

=== EMERGENCY CHANGE LOGIC (BAI06) ===
Result: PASS

Document: change-policy-bai06.md
Emergency change process is mentioned.
Post-Implementation Review (PIR) requirement found.
Emergency changes have a documented PIR requirement (or no emergency process).

Getting Started

Add your current change process or risk matrix to the project workspace, then activate the Change Impact Scorer (COBIT BAI06) skill. The agent will draft the policy and run emergency_change_logic until PIR for emergency changes is documented.