Seven steps for a quality change and configuration management program

This tip outlines several ways to ensure you have a topnotch change and configuration management (CCM) division on your project team which is vital in protecting software code.

John Scarpino
John Scarpino

As an imperative part of the quality assurance process, change and configuration management (CCM) manages and maintains all alterations to software documentation, infrastructure environments and application codes in order to ensure that no unauthorized changes are made. CMM is a "portal" that all software development changes must pass through and may be run either by a group of people working together in a traditional departmental setting, or in a silo where only one or two individuals are responsible for it. But since CMM's QA role is so defined and many companies have a hard time finding a single person with enough niche experience to fill it successfully, it is usually managed by a group.

Related content
Inexpensive phase of SDLC to catch and fix bugs
Is there a phase in the development lifecycle where bugs can inexpensively repaired? This is a common question asked to our expert Kevin Beaver.


Related content
Static analysis at the end of the SDLC doesn't work
Use security static analysis in concert with other analysis capabilities early in the SDLC to remedy problems faster and help programmers code better.


The CMM execution process must be well defined and take the entire network, database and software architecture into account. Here are seven key points to keep in mind that can help CMM get off to a good start.

  1. Communication is vital. The group or department responsible for executing the CMM process is the epicenter of the project and will be relied upon to convey information about its progress to other groups. Knowing the who, what, when, why, and how is a critical and everyday task of the CCM team.
  1. CCM Process and Methods:

    1. Internal processes for any deployment scripts, changes to infrastructure, and documentation is key. The team must be in-sync so that the proper changes are made correctly, on time and in the right place.
  1. The technique(s) used during the CMM process will affect changes to deployment, software environments and changes to the documentation, thereby affecting the project's overall success.
  1. External processes forensuring that any changes made by someone outside of the CMM department should always be documented and authorized by someone in the CMM department.
  1. Having an emergency/backup plan is a necessity just in case an attribute is missing or the software is not fully operable in time for the go-live deadline. The CMM team is akin to a "firefighter" in situations such as these, because they are only called to the scene when the building is burning and someone needs help.
  1.  It is very important to document all internal and external procedures. All technical changes should be recorded in a single database as they occur so that a timeline can be created and historical information is readily available for review, if or when a defect occurs. However, the CMM team must be careful not to become the only team in charge of documentation. This duty should be shared with others so as to avoid infiltrating the recorded text with biased data – in other words, the CMM team cannot be the only group in charge of making the change and also the only group in charge of recording it in the database.
  1. Make project planning, requirements review and analysis a part of the CMM group's responsibility. Traditionally, CCM is only contacted when changes to a piece of software are needed, and sometimes the same changes need to be made to that piece of software over and over again. Involving the CCM team in project planning, requirements review and analysis from the beginning of the software development process will help them identify areas that may be prone to problems, thereby allowing the team to anticipate and prepare for the change before the issue becomes unmanageable.
  1. Change- and time-management should not interfere with the CMM group's real responsibilities. For instance, any external change activity related to deployment should be conducted off-hours and on a consistently scheduled timeframe. If too many changes are made on the fly, the door opens to "requirements-creep" and a whole host of other QA issues. Internal changes should occur at daily or weekly intervals so that other departments can expect where and when they will occur.
  1. Establishing a solid reporting and control method can help the CCM group assure that every change is current and all environments are up-to-par. The method should make it simple for CMM to track and communicate present and future changes, issues that are or will be fixed, and defects that were found. In order for a CCM department to achieve success, it must practice awareness.

Change and configuration management must have a strong architecture and backbone process within the company for successful quality results. Following these seven steps are certain to help ensure that a successful Quality Change and Configuration Management process exists within your company and individuals projects.

About the author: John Scarpino is director of quality assurance and a university instructor in Pittsburgh. You may contact him at [email protected].

Dig Deeper on Topics Archive