Change Risk Policies

Change risk policies

Change Management → Settings → Risk policy · Added in 4.10.0 (#246, requested by Dr4inder)

Rate changes on your organisation's own risk scale: its likelihood and impact levels, what each level means, its results and the result every combination gives. If your information security policy uses four levels - gering / mittel / hoch / sehr hoch - FreeITSM can use exactly those, with your criteria shown beside the fields.

Until you set one up, nothing changes: every change is rated on the built-in 5 × 5, as before.

Related: Change Management · How to rate the risk · developers: Change risk policies - Developer Guide

---

Setting up your policy

Open Change Management → Settings → Risk policy. You need the permission Manage the change risk policy; administrators have it.

The editor starts as a copy of the policy in use - the built-in 5 × 5 the first time - so you change what you need rather than start from nothing.

Part	What you set
Name	Shown on every change rated under it, e.g. Information security policy 2026
Likelihood levels	2 to 10, lowest first. A label for each (gering) and what it means here - the criteria from your policy
Impact levels	The same, separately. The two can have different numbers of levels and their own criteria
Results	2 to 8, lowest first, each with a colour
Matrix	For every likelihood and impact, which result it is. Rows are likelihood, highest at the top, as on a change; columns are impact

Add puts a new level after the highest one; × removes one. Adding a level adds an empty row or column to the matrix - you decide what those cells are. The policy cannot be saved with an empty cell, a result without a colour, or two levels with the same name.

Save asks you to confirm, then the policy is in use for new ratings straight away.

There are no built-in percentages, outage times or four-level formulas: the words and the matrix are yours.

Workflows compare the result's name. If a workflow condition says risk is High, and your new policy calls it hoch, update the condition. The page reminds you beside the results.

---

What happens to changes already rated

Nothing. Every save makes a new version of the policy, and a version is never edited. Each change remembers the version it was rated under, so:

• a change rated 5 × 5 = 25 Critical on the built-in scale still says exactly that, with its 5 × 5 matrix, after you switch to four levels;
• what an approver approved is what the change still shows;
• a rating of 5 is never squeezed into a four-level scale.

The In use box lists every version, newest first, with how many changes were rated under each.

Moving an older change onto the current policy

Open the change and press Edit. Under the ratings it says "Rated under Built-in 5 × 5, an earlier risk policy." - saving the change as it is leaves the rating alone.

Press Re-assess to rate it again: the two fields empty and offer the current policy's levels. Choose both and save. The change's history records the move, for example Risk policy: Built-in 5 × 5 → Information security policy (version 1).

If the change has been approved and the risk ratings are among the fields that need a fresh approval (Settings → Approvals - they are by default), a re-assessment needs approving again, even if you pick the same numbers: 3 of 5 and 3 of 4 are not the same rating.

---

Rating a change

The Risk likelihood and Risk impact fields offer your levels by name. The ? beside either opens the guide with your criteria for every level, and the note under it says which policy it is. The result appears beside the fields in its colour, taken from your matrix.

On the change, the matrix is drawn at your policy's size - 4 × 4 for a four-level policy - with the change's cell outlined and the policy's name under the ratings.

---

Templates

A standard-change template remembers which policy its ratings were given under.

• Raising a change from a template rated under another version leaves the two risk fields empty, with a message to rate the change. The template's other fields still fill in.
• Such a change is not pre-authorised by the template, because its risk is not what was approved.
• To bring a template up to date, open it in Settings → Templates, press Re-assess, rate it and submit it for approval again.

---

Going back to the built-in

Use built-in puts new ratings back on the 5 × 5. The versions you saved stay, and so does every change rated under them.

---

Elsewhere

Where	What it shows
Change list and table	The result in its policy's words and colour
Evidence export	The ratings by name (gering (1 of 4)), the score, the result and the policy
Report Packs	Changes by risk groups by result, each in its policy's colour
REST API	Ratings are checked against the policy; each change's risk says which policy; GET /change-risk-policy returns the one in use - see REST API: Changes

---

Questions

Can each company have its own policy? Not yet - one policy applies to every company. FreeITSM already looks the policy up by the change's company, so this can be added later without changing how changes are stored.

Do I need to run Database Verification? Yes, after upgrading, as usual. Until you do, the Risk policy tab says so and everything keeps using the built-in 5 × 5.

Are my words translated? No - they are your policy's words, shown as you typed them. The built-in 5 × 5 is still shown in each person's language.