Diagnosis

39 MIN READ

Change Risk Assessment and Change Planning Strategy

Change risk assessment identifies risks and readiness gaps to guide organizational change planning and strategy before you launch a change initiative.

Why do modest changes stall while sweeping ones land? A plan sized to the change, rather than to the people receiving it, misreads the risk from its first day. The discipline that corrects this is change risk assessment: weighing the change against the organisation it lands in, one impacted group at a time, while the strategy can still bend.

What a Change Risk Assessment Is in Organisational Change

A change risk assessment in organisational change is best understood through two things Prosci attaches to it: the four objectives the practice is meant to serve, and the point in Phase 1 of the Prosci 3-Phase Process where it runs.

Both are easy to skip past, because most teams first meet the assessment as a form to fill in, and a form says nothing about what its answers are for or when they can still change anything. The IT service management meaning of the term, a score on a change ticket, belongs to a separate practice with a separate method.

Prosci’s Four Objectives

Prosci lists four objectives for a change management risk assessment in its article Do You Need a Change Management Risk Assessment?, and each one names a different decision the findings should feed.

The list reads like a set of benefits, and reading it that way wastes it. Each objective is a question the team should be able to answer once the assessment is done. If one of them has no answer, the assessment is incomplete however many boxes were filled in, and the gap usually shows up later as a decision made on instinct.

Finding Where Resistance Might Emerge

The first objective is identifying potential barriers where resistance or challenges might emerge. The assessment does this by looking at what the change asks of each affected group and what that group brings to it, which points to the specific groups where resistance to change is likely to form and the reasons it will form there: a loss of local control, a workload spike, a previous change that went badly.

The value is in the targeting. Resistance management spread evenly across an organisation is thin everywhere, while resistance management aimed at two named groups, with their likely objections already written down, can start with conversations before the announcement. In a move to shared services, for example, the regional finance teams that lose local control of approvals can be identified and consulted weeks before the design is shared with them.

Sizing Effort and Resources

The second objective is determining the level of effort and resources required to manage the change effectively. The assessment turns into a scale decision: how many change practitioners the initiative needs, how much of the sponsor’s calendar it claims, and how many weeks of training and coaching each population receives.

Timing gives this objective its force. Change management budgets are often set as a fixed share of the project budget or as whatever remains after delivery costs are covered. A sizing grounded in assessed risk gives the change lead an evidence-based argument while budgets are still open, and a request for two extra coaches in one region is far easier to approve during planning than as a rescue after go-live.

Using Data for Tactical Decisions

The third objective is using data to guide tactical decisions. Rollout sequence, pilot selection, channel choice and the order in which groups are trained all become choices with a recorded basis, because the assessment captures scores and the reasons behind them for each group.

Without recorded data, tactical choices default to habit or to whoever argues hardest. A team that can see one group scoring as change-ready and another as strained can pilot with the first, learn from it, and carry that experience to the second. The record also lets a later reviewer trace why a choice was made, which is what allows the practice to improve from one initiative to the next.

Engaging the Sponsor

The fourth objective is promoting sponsor engagement via actionable insights. Sponsor engagement here means handing the sponsor a picture they can act on: which groups carry the most risk, what is driving it, and which of those risks only the sponsor’s authority can shift.

General requests for support rarely move a busy executive, while a specific group with a specific problem usually does. When the finance director sees that the regional teams in the shared-services move will lose approval rights and have not been consulted, attending the regional design walkthrough becomes an obvious use of an hour. A sponsor who has seen the risk picture early also tends to treat the people-side risks as part of the business case they answer for.

Where It Sits in Phase 1

Prosci defines a change management risk assessment as a strategic process that uncovers looming obstacles to a change initiative, and it places that process inside Phase 1 of the Prosci 3-Phase Process, where teams build a customised change strategy.

Placement is the part teams most often lose. A strategic process only does its job while the strategy is still open; run once the plan is written, the same questions produce an audit of decisions nobody intends to revisit.

Prosci gives the reason the assessment has to be done fresh for each initiative: both organisations and change initiatives have unique attributes. A reorganisation that went smoothly in one business unit tells the team little about a system replacement landing in another, because the change and the receiving organisation are both different. Phase 1 is where those attributes are still inputs, shaping who joins the sponsor coalition, how large the change team is and how the rollout is sequenced.

The cost of skipping Phase 1 placement is concrete. Prosci’s own account of the risk of failing to account for these obstacles early is disruption down the road that reaches organisation-wide strategies and whole teams. The goal Prosci names for the assessment is to empower the organisation to act, not react. A risk found in week two becomes a planned action with an owner and a budget line. The same risk found at go-live arrives as a surprise, usually from a group nobody consulted, and by then the only responses left are the expensive ones.

IT Change Risk Versus Organisational Change Risk

Change risk assessment carries two meanings, and separating them comes down to three parts: how IT change risk models score a ticket, what history an organisational transformation has to offer by comparison, and how structured judgement compares with prediction.

Readers searching the term often land on IT service management pages first, and the shared vocabulary (risk, change, assessment, score) makes it easy for a change lead to borrow a method built for a different problem without noticing the switch.

How IT Change Risk Models Work

In IT service management, change risk is a score attached to a change ticket that estimates how likely the change is to cause an incident, and IT change risk scoring produces that number from past tickets.

IBM’s documentation page About change risk describes the version built into IBM Cloud Pak for AIOps: an unsupervised learning algorithm that takes historical data about past changes and estimates how likely a specific change is to cause a problem, based on how successfully similar changes were deployed before. The approach has its own research literature. Eileen Kapel and Jan Lennartz of ING Bank and Luis Cruz of Delft University of Technology co-authored research on predictive models for IT change-risk assessment, published on arXiv as 2604.13462.

Training on Change and Incident Tickets

IBM’s change risk model trains on change request and incident ticket data from ServiceNow, and IBM requires a working ServiceNow integration before training can be set up. When historical collection is switched on during that integration, tickets from the selected timeframe become available to train on, and the algorithm learns which features of past changes tended to precede incidents.

The model only knows what the tickets record. A change counts as failed when an incident followed it, so the quality of the score depends on ticket discipline: an incident logged against the wrong configuration item, or never linked to the change that caused it, teaches the model the wrong lesson. Teams that adopt these models tend to discover that cleaning their ticket history is most of the setup work.

The 10,000-Ticket Data Threshold

IBM documents that around 10,000 change tickets, with a minimum 2% failure rate, is considered ideal training data, and that the set needs a mix of successful and failed changes. IBM also notes that models can be created with much less data. At the ideal size, the model has roughly 200 failed changes from which to learn what failure looks like.

IT change risk scoring works because it rests on large volumes of comparable history, and that dependency is exactly what an organisational change risk assessment cannot satisfy. A large enterprise might run a handful of major transformations in a decade. Even counting every reorganisation and system rollout, the total stays in the dozens, well short of the failed changes alone that IBM’s ideal training set contains.

Alerting on High-Risk Changes

Once the model is trained and deployed, opening a change request ticket brings a change risk assessment into IBM’s ChatOps channel, and an assessment deemed high risk generates an alert in the Alert Viewer. The score arrives at the moment the change is proposed, before anyone approves it.

That placement shows what the IT score is designed for: gating a single technical deployment. A high score leads to more testing, a different deployment window or a rollback plan. The question it answers is whether this ticket should proceed now, and an organisational change risk assessment asks something else entirely, which is how much help each group of people will need to adopt a new way of working.

Why Transformations Lack Comparable History

A transformation’s history fails as training data on three counts: each one changes a different organisation in a different way, none ends with a clean success-or-failure label, and the organisation itself learns from every attempt.

The intuition that a large company holds plenty of change history is right about activity and wrong about comparability. A change ticket either preceded an incident or did not, usually within hours. A transformation’s outcome takes months or years to show, and it is rarely binary: a new operating model may be adopted in two regions, partly adopted in a third and quietly abandoned in a fourth. Labelling that as success or failure loses most of what happened.

Scope, sponsor, timing and culture differ from one transformation to the next as well, so two programmes that share a name, such as two ERP rollouts five years apart, may share almost nothing that drives adoption. The organisation that met the second rollout had already absorbed the first, and if the first went badly, people carried that memory into the second. A past change alters the system the next change meets. That memory is real evidence about the organisation, and it breaks the independence between cases that a statistical model assumes.

The history is still worth gathering. What it offers is a dozen dissimilar cases that describe one organisation’s habits, which leaves the open question of what kind of method can make use of them.

Prediction Versus Structured Judgement

Structured judgement replaces the trained model with defined questions, scored by people who know each affected group, with stakeholder evidence and written reasons standing where ticket history would stand in an IT model.

The trade is uncomfortable for teams used to IT dashboards. Judgement gives up the calibration and repeatability of a model. It gains the context no ticket holds: what a regional manager said in last month’s leadership meeting, which team lost two senior people, how the last reorganisation was received. The method works when the questions are fixed in advance and several people score independently before comparing.

Dimension	IT change risk scoring	Organisational change risk assessment
Unit assessed	One change ticket	One change, per impacted group
When it runs	When the ticket is opened	During strategy work, then at each re-score
Who acts on the result	Change approver or advisory board	Change lead and sponsor
Reversibility of what is assessed	A deployment can be rolled back	An announcement to people cannot be taken back

Judgement has known weaknesses: scorers rating groups they have never worked with, and confidence that outruns evidence. A judgement made by one person with no evidence is a guess with a score attached, and the team that relies on it learns how wrong it was at go-live.

Risk of the Change Versus Risk of the Organisation

Change risk assessment weighs two separate things, Prosci’s change axis and its organisation axis, and puts them to the test on the case of a small change that turns out to carry high risk.

Prosci’s help-centre page on Risk Assessments names the two parts of its assessment Change Characteristics and Organizational Attributes. Most teams score the first carefully and guess at the second, because the change is documented in a business case and the organisation is documented nowhere.

The Change Axis

Change Characteristics describe the change itself, its size and its scope, and the two need separate scores because a change can be large without being wide, or wide without being large.

A new pricing engine for one sales team is large and narrow, while a revised expense policy sent to every employee is small and wide. Blending the two into one number loses that distinction before the scoring has properly started, and the distinction is what tells the team where the change will bite.

Size of the Change

Size is how much changes for the people affected: how many of their processes, tools and roles alter, and how far the new way of working sits from the old one. It is measured from the receiver’s position. A system replacement that keeps familiar screens and steps can be small for its users, while a policy tweak that rewrites how people are paid or evaluated can be large.

Project budget is a poor proxy for this, and using it misdirects effort. A costly infrastructure migration that users never notice would score small, and a modest change to a sales force’s commission plan would score large. Scoring size by spend pushes change management resources toward expensive projects and away from the changes that ask the most of people.

Scope of the Change

Scope is how widely the change reaches: how many groups, locations and functions it touches, and whether it crosses organisational boundaries. Each additional group brings its own route to adoption, and a change that cuts across functions needs managers who share no reporting line to move in step.

Scope multiplies the places where adoption can stall. The same process change carries very different weight in one department than across twelve countries with different languages, labour arrangements and works councils. Wide scope also multiplies the number of sponsors whose commitment the change depends on, and each one is a place where the change can lose momentum without anyone deciding to stop it.

The Organisation Axis

Organizational Attributes describe the receiving organisation, whether it is change-ready or change-resistant, and they capture what the organisation brings to the change before anyone has heard of it.

A full change readiness assessment is a separate diagnosis with its own instruments. Inside a risk assessment, the organisation axis is one input to a risk score, and it needs only enough evidence to place the organisation honestly.

Change-Ready Organisations

A change-ready organisation has completed and sustained earlier changes, has leaders who sponsor actively, has managers equipped to coach their teams, and has people who broadly share the reasons change is needed. Those traits lower the effort each unit of change costs, because the organisation already has routines for hearing about, testing and adopting new ways of working.

Readiness works like a resource the plan can spend, and it can be overspent. A group that ran a successful pilot last year will tend to pick up a new tool with light support, which frees change effort for groups that need it more. Pushed through too many changes in a row, the same group loses that readiness, and a later assessment will score it very differently.

Change-Resistant Organisations

A change-resistant organisation carries a history of failed or reversed changes, sponsors who announce and then disappear, middle managers who were not consulted, and norms that reward stability over experiment. Each failed change teaches people that waiting it out works, and that lesson compounds.

Resistance raises the cost of every unit of change. Where the last two initiatives were quietly abandoned, staff tend to watch whether a new one survives its first quarter before investing any effort in it. A high resistance score is a signal that sponsor visibility and manager preparation have to come before training, because training delivered to people who expect the change to fade is forgotten by the time it matters.

When a Small Change Is High Risk

Judging risk from the size of the change alone ignores the organisation it lands in, and that blind spot falls hardest on small changes, which receive the least support.

It follows, as an inference from Prosci’s two axes and not a claim Prosci makes, that a small change in a change-resistant organisation can carry more people risk than a large change in a change-ready one. Risk sits in the interaction between the change and the organisation, and neither axis predicts it alone.

Take a professional-services firm adding one mandatory field to its timesheet so that client work can be billed by project phase. On the change axis it barely registers: one field, a few seconds a day. In a firm whose consultants saw two earlier time-tracking initiatives reversed, and whose partners were never asked about this one, the field gets filled with defaults, the billing data is useless, and the commercial goal behind the change fails.

The change lead’s case for proportionate support rests on that evidence from the organisation axis, presented next to the change score so a sponsor can see why a one-field change has earned a sponsor message and partner briefings. Under-supported small changes rarely fail loudly. They decay into workarounds that nobody records as failure, and the next change inherits a slightly more resistant organisation.

Scoring the Risk Grid by Impacted Group

Scoring the Risk Grid for a change risk assessment involves three moves: plotting the two scores, repeating the scoring for each impacted group, and being clear about what the grid can and cannot decide.

Each move on the Prosci Risk Grid is simple on its own, and the difficulty lies in reading what the dots say once there are several of them.

Plotting the Two Scores

Prosci’s help centre states that the Change Characteristics and Organizational Attributes scores are plotted on the Risk Grid, and that the resulting position defines the people risk of the change.

The mechanics are quick, and the judgement lies in the scores that go in. Prosci’s Risk Assessments guidance has practitioners fill in both sections and mark the assessment complete, and the scores do not appear on the Risk Assessment Analysis visual until every score has been entered, so a half-scored assessment shows nothing at all.

Reading the Position

The grid gives each score its own axis, so a position records two facts: how much the change asks of people, and how ready the organisation is to give it. Reading the position starts with which axis pushed the dot where it sits and only then asks how far. A small change in a ready organisation sits in the low corner. A large change in a resistant organisation sits in the opposite corner, and the two mixed corners describe changes driven by size and changes driven by the organisation.

Two positions with the same overall level of risk can need opposite treatment, which is why the reason for each score belongs next to the dot. A team that records “high, because the regional managers were not consulted” can act on it; a team that records only “high” has to rediscover the reason at the next review, usually after the group in question has started pushing back.

What the Position Means for Effort

Prosci describes the purpose of the assessment as customising and scaling the change management approach. Scaling adjusts the amount of effort, and customising adjusts its kind. Each axis points to different levers: a position driven by the change axis calls for training, communication and transition support in proportion to how much is changing, while a position driven by the organisation axis calls for sponsor presence, manager coaching and resistance management that starts earlier.

Sizing effort by the height of the position alone sends the wrong kind of help. A small change landing in a resistant group does not need a longer training course; it needs a visible sponsor and managers ready to answer the question “why again?” A large change in a ready group needs the reverse: practical training, floor support and clear materials, with less persuasion. Reading the axis before setting the effort keeps the budget pointed at the cause.

Scoring by Impacted Group

Prosci supports a Risk Assessment by Group, which lets a practitioner score each impacted group separately instead of giving the whole change one position.

In Prosci’s tooling the practitioner opens the Impacted Groups page, chooses a group, selects View Assessment, and completes the Change Characteristics and Organizational Attributes sections on the Risk Assessment by Group tab. The extra scoring takes little time. Agreeing what counts as a group takes longer, and it matters more.

Groups are best defined by how the change touches them, by role, location or function, rather than by the org chart. Two departments that experience the change identically can share a score, while one department whose night shift and day shift experience it differently needs two.

When Groups Land in Different Positions

Each impacted group gets its own Change Characteristics and Organizational Attributes scores, so the same change can put different groups at different positions on the grid. The change axis varies because the change asks different things of each group, and the organisation axis varies because each group has its own history, its own managers and its own current workload.

Consider a new procurement system rolled out across a manufacturing company. Buyers at head office face a large change, with a new tool and new approval rules, but they are change-ready and asked for the system. Site managers face a small change, approving requests on a phone, but they work in a plant network where the last system rollout was abandoned halfway. Two positions mean two plans: training-heavy support for the buyers, and sponsor and supervisor work for the site managers. The change plan becomes a set of group plans.

Finding the Hotspot Group

A single project-level score can hide one group that sits far higher on the grid than the rest. If nine groups sit low and one sits high, the averaged position looks moderate, a moderate plan follows, and the one group that needed intensive support receives the same moderate treatment as everyone else.

Finding the hotspot means reading the highest position, not the average: sort the groups by position, look for any group where both axes score high, and check each group’s influence as well as its size. A forty-person field-engineering team whose sign-off gates go-live matters more than its headcount suggests. A hotspot found this way is often already known to someone in the room, and the scoring gives that person’s warning a number others can act on.

Why the Grid Is Not a Go/No-Go Verdict

The grid position is an input to how much change management effort and sponsorship a group needs, and it does not decide whether the change should go ahead.

The go/no-go decision belongs to the sponsor and the business case, which weigh benefit, cost and strategic need. People risk is one factor in that decision, and the grid measures nothing about benefit. A change with a high-risk position may still be essential, and a low-risk change may still be a poor investment.

Treating the grid as a gate also corrupts the scores. When a high position can block a project, project teams learn to score low, honest high scores disappear, and the assessment stops seeing the groups it exists to find. The scoring stays honest only while the people doing it are confident that a high score will not be used against their project.

There is one legitimate overlap with decisions about the change itself: a high position can shape timing, such as moving one group’s go-live later than the rest. That is still a planning decision about how the change goes ahead, and the delay it buys is only worth having if the group’s support work fills those extra weeks.

The People Risks a Project Risk Register Misses

Tandem Coaching describes the purpose of a change risk assessment as surfacing the human, cultural and leadership risks that a standard project risk register never tracks, and it evaluates them in three areas: sponsor readiness, cultural capacity and change fatigue.

Its guide Change Management Risk Assessment: The 3 Risks You Miss (Tandem Coaching) builds that argument around a single programme’s register, and the human risks it names sit alongside the delivery risks a project team already manages without ever appearing among them.

The 47-Risk Register That Missed the Directors

Tandem’s example is a programme whose risk assessment met every project-management standard and still left its most consequential risk undocumented.

The case is useful precisely because nobody in it was careless. The project team did everything the risk management playbook asked of them, which makes the case a test of the playbook itself rather than of the people who followed it.

What the Register Tracked

The register covered budget overrun scenarios, technology failure modes, vendor dependency analysis and regulatory compliance gaps: forty-seven risks, documented, categorised and colour-coded. Each category comes from the delivery side of the project, covering things that cost money or time and have a mitigation the project team can carry out.

That thoroughness is real and valuable, and it creates a sense of completeness. A long, colour-coded list reads as coverage in a steering meeting, where committee members see rows of amber and green and reasonably conclude that the risks are known. Nobody in that meeting is prompted to ask which categories are missing, because the format offers no place to see an absence.

What It Missed

Not one of the forty-seven risks addressed the fact that three of the five regional directors did not believe the change was necessary. Tandem explains why: leadership readiness is not a standard risk category, so the directors never appeared on the register. Directors control regional rollout plans, staff time and the messages their managers repeat, so their disbelief turns into slow, deniable delay.

The risk stays invisible in delivery metrics until adoption figures arrive, by which point the regions have already set their own pace. Tandem also points to the gap between what a sponsor promises at kickoff and what that sponsor actually does when the change gets difficult, another risk no delivery category records. With three of five regions led by unconvinced directors, most of the rollout depended on a risk nobody owned.

Tandem argues that sponsor capability, not plan quality, is the strongest predictor of change success, which makes sponsor readiness the first of its three areas to assess.

Sponsor readiness asks whether the sponsor will do what sponsorship requires once the change gets hard: stay visible to affected groups, build a coalition among peers, hold managers accountable for adoption and defend the change budget when other priorities press. Stated support at a kickoff says little about any of these.

The mechanism behind Tandem’s claim runs through managers. Line managers take their cues from what the sponsor does, so a well-designed plan delivered under a disengaged sponsor stalls as managers quietly deprioritise it. A plan with gaps, run under a capable and present sponsor, tends to get corrected along the way, because the sponsor notices problems and has the authority to fix them.

Assessing a sponsor is politically awkward, since the sponsor often commissions the assessment. Evidence of behaviour makes it workable: whether the sponsor has led a comparable change before, how much time is blocked in their calendar for the change, and whether they will speak directly to the groups most opposed to it. Skipping it means every group gets scored carefully while the one person whose behaviour moves all of them goes unscored.

Cultural Capacity

Cultural capacity is the organisation’s ability, given its norms and habits, to take on the specific way of working a change asks for, and it is assessed by asking how well the change fits what people already value and reward.

It overlaps the organisation axis but looks at something narrower. The organisation axis asks how ready the organisation is for change in general, while cultural capacity asks whether this particular change runs with or against the grain. A change asking managers to report problems early, landing in a culture where bad news has historically ended careers, will meet compliance in form and the old behaviour in practice.

Evidence for cultural capacity rarely sits in documents. It shows in the stories people tell about past changes, in which behaviours actually get promoted, and in what happens to someone who raises a concern in a meeting. Asking a few people from each affected group what would happen if they adopted the new behaviour fully usually reveals more than any survey.

A low cultural-capacity finding changes the plan’s emphasis: leaders have to model the new behaviour visibly and reward early adopters before the change can scale. Where that modelling is absent, people read the gap between the stated change and leaders’ conduct accurately, and they follow the conduct.

Change Fatigue as a Risk Input

Change fatigue enters the assessment as a risk input when a group is still absorbing earlier changes, and Tandem’s example names its shape: an organisation that has been through three transformations in eighteen months.

Fatigue reduces the attention and goodwill a group can give to anything new. People in fatigued groups skim announcements, delay learning anything that may soon be replaced, and conserve energy for their day jobs. A project risk register cannot see this, because it treats each project as if it were the only one the group had ever experienced.

Inside the assessment, fatigue belongs in the scoring of each group: what else changed for these people in the last year or two, and how much of it is still settling. A group that has absorbed a new structure, a new system and a new manager in quick succession should score very differently from one that has had a quiet two years, even if both face the same change.

Sizing that accumulated load precisely is the work of change saturation analysis. For the assessment, a recorded count of recent changes for each group is enough to move its score, and leaving it out guarantees that the most fatigued group receives the same plan as the freshest one.

Why a Risk Checklist Is Not Enough

A risk checklist gives a change risk assessment its shape, and weighing what the checklist adds against what it leaves out takes three parts: what templates do well, how the response should match the threat, and how the assessment works as a structured conversation.

Teams asking for a risk assessment template are usually asking for speed and coverage, and a template delivers both. The open question is what the template does to the thinking of the people who fill it in.

What Templates Do Well

A risk assessment template gives consistency: every project answers the same questions on the same scales, so results can be compared across a portfolio and nothing obvious gets skipped.

That consistency has real uses across an organisation. New change leads learn what to ask by working through it, sponsors pick up a shared vocabulary for people risk, and auditors can see that an assessment happened. For organisations early in their change practice, a template is often the fastest way to make assessment routine.

Completing a checklist or template, however, does not show that the team understood the risks it recorded. Harvard Business Review authors Robert S. Kaplan and Anette Mikes describe the wider version of this problem, writing in Managing Risks: A New Framework (Harvard Business Review) that risk management is too often treated as a compliance issue that can be solved by drawing up lots of rules and making sure that all employees follow them.

The failure sequence in change work is familiar. The template becomes the deliverable, one person completes it the night before a steering meeting, scores are carried over from the last project, and the steering committee sees a finished document and moves to the next agenda item, while the regional teams first hear about the change from a launch email.

Matching the Response to the Threat

Kaplan and Mikes argue in Managing Risks: A New Framework (Harvard Business Review) that smart companies match their approach to the nature of the threats they face.

In change work, that principle means the response depends on the kind of people risk the assessment found.

Applying that principle to change risk is a proposal drawn from it, since the HBR summary does not address change management directly. A template tends to attach the same mitigation to every risk, usually more communication, because communication is what the project team controls. Different people risks respond to different moves.

Sponsor Risks Need Conversations

A sponsor risk exists when the sponsor’s commitment or capability is in doubt: they approved the change but are absent from it, or they support it in private and hedge in public. The response is a direct conversation with the sponsor, built on the assessment’s evidence, that agrees specific visible actions: which meetings they attend, which message they deliver, to which groups.

Teams tend to avoid this conversation and add communication instead, which fails because project-team messages cannot stand in for the sponsor’s voice; people watch what the sponsor does. In practice the mitigation reads as “the change lead and a peer of the sponsor meet the sponsor before the design announcement and agree three visible actions.” If the conversation fails, the risk moves up to whoever appointed the sponsor.

Capacity Risks Need Resequencing

A capacity risk exists when a group lacks the time or attention to absorb the change: its go-live collides with peak season, a year-end close or another rollout. The response is to change the sequence of work, by moving that group’s go-live, splitting the rollout, or deferring training until after the peak, because persuasion creates no extra hours.

Teams often answer capacity risk with more training sessions or more communication, which adds load to a group that already has none to spare. A finance team asked to learn a new system during quarter close will learn it badly, while the same team trained three weeks later will learn it properly. Resequencing costs schedule, which is why it needs the sponsor’s and project manager’s agreement while the plan is still being set.

The Assessment as a Structured Conversation

Used well, a change risk assessment is a structured conversation that tests the team’s assumptions about how people will respond to the change.

The questions give the conversation its structure, and disagreement gives it value. When the project manager scores a region as change-ready and the regional lead scores it as resistant, the gap between the two scores is the finding, because it exposes an assumption one of them holds and the other has evidence against.

Every change plan rests on assumptions of this kind: that managers will cascade the message, that the sponsor will attend the launch, that training is enough for a group to adopt. The conversation surfaces them by asking each scorer for the evidence behind a score and recording dissent rather than averaging it away.

Whether that happens depends on how the session is facilitated. Asking people to score silently first, then reveal their scores together, stops the most senior person’s number from anchoring everyone else’s. Asking “what would have to be true for this group to adopt without help?” turns a vague worry into a testable statement. And giving the person who knows the affected group best the last word on its organisation score, with their reasons recorded, keeps the people closest to the work in charge of describing it.

Assumptions that survive challenge become foundations the plan can build on, and those that fail it become the risks the session records.

How to Run a Change Risk Assessment Session

Running a change risk assessment session comes down to four choices: who is in the room, what evidence they bring, when in the project the session happens and how its output is captured, and The Change Compass gives a working answer to each.

Its Change Risk Assessment Playbook (The Change Compass) is deliberately light enough to fit into a project calendar, which matters because an assessment nobody can schedule does not happen at all.

Who to Invite

The Change Compass playbook plans a 45-minute session with five or more people, drawn from the whole project team plus key business stakeholders, and booked well in advance so they can all attend.

The playbook adds that the business owner, the project manager and the business representatives should definitely participate. The guest list does most of the work of making the scores trustworthy, because each person brings evidence about a different part of the picture.

Project Team and Business Stakeholders

The whole project team knows what is changing, so it can score the change axis with authority. Key business stakeholders know the groups receiving the change, their history and their current load, so they can score the organisation axis. Neither group can score both axes alone.

An assessment scored by the project team alone tends to overrate readiness, because the team has lived with the change for months and forgets how unfamiliar it is to everyone else. A business representative from a warehouse network may point out that the night shift was left out of every consultation, revealing an impacted group that was missing from the list entirely. One remark of that kind justifies the session.

Why Technical Members Belong in the Room

The playbook recommends including technical team members because change risks and technical delivery have cross-implications in both directions. Technical choices set much of what users experience, including data migration scope, cutover timing and which integrations are ready on day one.

A decision to migrate only two years of transaction history, for example, means users lose access to older records, a people-side impact the change lead may not hear about until a technical member mentions it in the session. The influence runs the other way too: a resistant group identified in the session can argue for a phased technical cutover in its region. Without technical members, both sides plan around assumptions the other could have corrected.

The Optional Risk Partner

Where the organisation has a Risk Partner, the playbook suggests engaging them to help facilitate the session. A facilitator who is not the change lead can push for evidence, keep scoring honest and connect the session to the wider project risk process, since the playbook notes the session can sit inside the overall project risk assessment or run as a stand-alone meeting.

The change lead is invested in the change and in the plan already drafted, which makes it hard for them to challenge optimistic scores from colleagues. A Risk Partner asking “what happened the last time this group was asked to change?” brings in that challenge without the politics. The role is optional because smaller changes with an experienced change lead often manage well without it.

Bringing Evidence, Not Just Opinion

The playbook asks for homework before the session, understanding typical foreseen and unforeseen risks from previous projects, so that identified risks factor in historical data and not just individual opinions.

Historical project data for a change risk assessment comes from several places: lessons-learned logs and post-implementation reviews, adoption figures from earlier rollouts to the same groups, help-desk volumes in the weeks after past go-lives, engagement survey results, and attrition after earlier restructures. Each source covers a different stretch of a past change, from launch week to the year after.

Opinion tends to anchor on the most recent or most vivid memory. A team that remembers one smooth rollout will score readiness high, while the help-desk data from that rollout might show three months of workaround tickets in one region. Evidence brought into the room gives the facilitator something to test opinions against, and it gives quieter attendees a reason to speak up. Gathering it usually falls to the change lead and takes a few hours in the week before the session.

The consequence of skipping the homework is predictable: the session spends its 45 minutes debating impressions and runs out of time before any mitigation is agreed. Sending the evidence pack two days ahead lets participants arrive with questions instead of first reactions.

When to Run It

Timing depends on delivery method: the playbook places the session in project planning for traditional projects and builds it into the whole lifecycle for agile teams.

During Planning on Traditional Projects

The playbook notes that the change risk assessment is typically carried out during the project planning process. On a traditional project, that means scheduling the session after the impacted groups are known and before the project plan is baselined.

The risk of a single planning-stage session is that it becomes a snapshot of an organisation that keeps moving. Long projects outlast sponsors and absorb other initiatives’ rollouts, so a sensible pattern is to re-score at the major stage gates, especially before the go-live readiness review. Each re-score takes far less time than the first, because the groups and the evidence are already in place.

Throughout the Lifecycle on Agile Teams

For agile teams, the playbook describes the risk assessment as integrated into the way of working across the project lifecycle, rather than done only at the beginning, and it stresses that the whole team contributes to the outcome. Agile teams deliver in increments, so the people-side impact arrives in increments as well, and each release can touch a different group.

A natural rhythm is to revisit change risk at each planning event or before any release that alters how a group works. A release that changes a field-service app for technicians earns a short re-score with the product owner and a field supervisor present. Keeping the assessment live this way prevents the common agile failure in which the technical backlog evolves weekly while the change plan stays frozen at its first draft.

Recording the Output

The playbook records the output on a change risk assessment form, kept in PowerPoint or Word, so the session ends with clear change risks identified and their mitigation plans agreed.

The playbook’s equipment list is short and practical. Remote sessions use video conferencing with screen sharing and a digital collaboration tool, while in-person sessions use a whiteboard, markers, sticky notes and a timer. The timer matters more than it seems, because a 45-minute session without one spends 30 minutes on the first risk.

For each risk, the form is most useful when it captures the impacted group, the risk itself, the evidence behind it, the score, the agreed mitigation and any dissent recorded during the discussion. Dissent is the field most often dropped and the one most worth keeping, since it marks the assumptions most likely to fail.

Writing the form up during the session, on a shared screen or a whiteboard everyone can see, is better than writing it up afterwards from memory. Attendees can correct a score or a wording in the moment, and the version that leaves the room is one they have all seen. A form completed later by one person drifts toward that person’s view of the discussion, and the others rarely read it closely enough to object.

The form becomes the baseline every later re-score is compared against, so it belongs in a shared project space where the next re-score will find it.

From Risk to Plan: Turning Findings Into Change Actions

A change risk assessment pays off at the handoff into the delivery plan, and Bain & Company’s research shows what is at stake there: only 12% of companies that launch major change initiatives fully achieve their goals, yet the risks of transformation are predictable and manageable.

Bain makes the case in Results Delivery: Busting Three Common Myths of Change Management (Bain & Company). The handoff has three parts: assigning each risk an owner and a stage, turning group hotspots into actions, and handling risk that comes from the wider portfolio.

Assigning Each Risk an Owner and a Stage

Bain’s Patrick Litré, David Michels, Ivan Hindshaw and Parijat Ghosh describe three stages toward a goal, installation, realization and repeatability, and each risk from the assessment can be tied to the stage where it is expected to bite.

The stage tells the plan when a risk needs its owner’s attention, and it often tells the plan who that owner should be, because different people hold responsibility at each stage.

Installation Stage

Bain explains installation with a home-gym analogy: buying the equipment and setting it up in the basement completes the first stage. Its business example is a company that installs collaboration software to bring engineers and salespeople closer, then finds that nothing changes because the effort stalls at installation, with no programme to encourage engineers to post product plans or product managers to give feedback.

Risks tied to installation have a deadline at go-live. The assessment’s job at this stage is to catch the people-side risks mixed in with the delivery work, such as a group that will have no access to the new tool on the day it launches. Their owners are usually the project manager and the training lead.

Realization Stage

Bain describes realization as the stage that requires steps people had not considered: drawing up an exercise plan, enlisting a coach, and spending eight to 12 weeks actually using the equipment. In change terms, it covers the weeks and months when people must work the new way and results begin to show.

Most people risks from an assessment land here, including resistance, fading sponsorship and managers who do not reinforce the change. Their owners are sponsors and line managers rather than the project team, which often disbands at go-live. Mapping a resistant region’s risk to realization makes its owner the regional head, with an adoption check scheduled weeks after launch. Without that mapping, the regional head first hears about the risk when adoption figures disappoint.

Repeatability Stage

Bain’s third stage, repeatability, means learning from experience so the next challenge can be met with muscle memory that makes the process familiar and systematic. For a change programme, it is the organisation’s ability to carry out its next change better because of this one.

Risks that bite at repeatability include lessons lost when the team disbands and a poorly ended change that lowers the organisation’s readiness for the next one. Their owner is whoever runs the change portfolio or the transformation office. Filing the assessment together with its actual outcome is the simplest action at this stage, since it creates the historical evidence the next assessment will need and shapes how the next change scores on the organisation axis.

Turning Group Hotspots Into Actions

Each high-risk impacted group from the Risk Grid should map to a named action, an owner and the stage where the risk is expected to appear, so that every hotspot becomes work someone is accountable for.

The pressure for this comes from adoption results. Gartner research reported in Harvard Business School Online’s guide to the change management process found that only 32 percent of leaders achieved healthy employee adoption in their most recent change initiative. Adoption risk that has no owner is simply accepted.

Hotspot pattern	Named action	Owner	Stage
Large change for a change-ready group	Role-based training and floor support for the first weeks	Training lead	Installation
Small change for a group with a history of reversed initiatives	Sponsor visit and manager briefings before the announcement	Executive sponsor	Installation
Supervisors expected to reinforce the change lack time to coach	Coaching time protected in supervisors’ schedules	Operations manager	Realization
Group adopting slowly after go-live	Monthly adoption review with targeted coaching	Line manager	Realization
Lessons at risk when the project team disbands	Assessment and outcomes filed for the next initiative	Transformation office lead	Repeatability

The table is a starting pattern, and each organisation fills in its own rows. The test of a finished row is whether its owner has agreed to it, since an owner who learns of the assignment from a document tends to treat it as optional.

When the Risk Comes From the Portfolio

The Change Compass defines portfolio risk as the combined exposure created when multiple initiatives compete for the same stakeholder capacity, a risk no single project’s assessment can see in full.

The Change Compass, which sells change-capacity software, notes that individual projects can look healthy on their own while the portfolio as a whole exceeds what the organisation can absorb, and that the gap is where benefits leak and productivity drops. Its free calculator asks ten portfolio questions and returns a 0 to 100 saturation score with a risk tier. Measuring that exposure properly is the work of change saturation analysis.

Within a change risk assessment, the practical step is to record, for each impacted group, which other initiatives will land on it during the same period, with their go-live dates. A risk that originates in the portfolio cannot be owned by one project, since that project has no authority over the others competing for the same people. Its owner holds authority across the projects, usually a portfolio lead or transformation office, and the action is a sequencing decision across initiatives, such as staggering two go-lives that would otherwise hit the same contact-centre team in the same month. Left inside one project’s plan, a portfolio risk is noted, escalated nowhere, and realised during the overlap.

How to Start Applying Change Risk Assessment

The simplest way to start applying change risk assessment is to take one change already in flight, score its two most different impacted groups, and compare the result with how the current plan spreads its effort between them.

That comparison is a small experiment with an observable result. If the plan gives both groups the same training, the same communications and the same sponsor attention while their scores differ sharply, the mismatch is visible within an hour, and the decision about what to do with it stays with the people who own the plan. If the scores and the plan already agree, that is useful evidence too: the organisation’s instincts are better calibrated than expected, and a full assessment can be saved for larger changes.

A boundary case deserves a deliberate answer: the very small change. Running a full session for a minor procedural tweak wastes goodwill and teaches people that assessment is overhead. A lighter path works for these: the change lead asks the two axis questions informally of one person from each affected group, and escalates to a full session only if either answer comes back high. The escalation rule has to be written down in advance, or every change will be declared minor.

The failure mode most worth guarding against is a sudden event that invalidates the scores between planned re-scores: a sponsor leaving, a merger announcement, a round of redundancies in an affected group. Naming those trigger events at the first session, and agreeing that any of them prompts an immediate re-score, keeps the assessment attached to the organisation as it actually is.

The last decision is whether to show each impacted group its own scores before the risk-informed change plan is finalised. Sharing them invites correction from the people who see their own situation most clearly, and it often surfaces a factor the session missed. It also risks a group reading “change-resistant” as an accusation. Teams that share tend to describe the organisation axis in terms of conditions, such as recent change load, past experience and manager support, rather than attitudes, which keeps the conversation on what the group and its leaders can actually alter.

Anonymous. Counted, not tracked.

Where is your organisation with this right now?

What is the hardest part where you are?

agility at scale