Change and Release Manager
Administration
SmartSuite for the Change and Release Manager
The Change and Release Manager governs changes to production: assessing risk, running the change advisory board, scheduling release windows and ensuring every change has a plan, a test and a rollback. They report change success rates and unplanned incidents caused by change.
Reports to:
What you own
The Change and Release Manager governs changes to production: assessing risk, running the change advisory board, scheduling release windows and ensuring every change has a plan, a test and a rollback.
- Own the change enablement and release management practices
- Assess change risk and route for the right level of approval
- Run the change advisory board and the change schedule
- Coordinate release planning, testing and deployment windows
- Ensure rollback plans and post-implementation reviews
- Report change success rates and change-related incidents
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
IT Service Manager
See the roleDirect reports
Works closely with
DevOps Engineer
See the roleIT Operations Director
See the roleIncident and Problem Manager
See the roleEngineering Manager
See the roleHow SmartSuite supports the Change and Release Manager
Every change to production passes through you, and the IT Service Manager, auditors testing change control and the business that lives with failed changes hold you to the outcome. SmartSuite gives a Change and Release Manager risk-assessed change records, release plans with tests and rollback steps, and incidents tied to the changes behind them.
Govern change and release from request to review
Each change request in Change Management is scored for risk and impact, then routed to the approval level that score requires, so standard changes move quickly and risky ones get the scrutiny they need.
ITSM suiteApproved changes, release windows and maintenance sit on a shared schedule, so collisions between a deployment and a change freeze are visible before the CAB meets, not after the outage.
ITSM suiteRelease Management holds the release plan, deployment windows, environments and the approved changes each release depends on, with test status and rollback steps recorded on the same record, so go-live decisions are made against a completed checklist.
IT Operations Management suiteCoordinate DevOps, operations and the service desk
Every change names the services and systems it touches, so the IT Operations Director and the Incident and Problem Manager can see what moved when a service degrades.
ITSM suiteDevOps Engineers and the Engineering Manager update test results and readiness in the same release record you present, so the CAB sees current status rather than yesterday's email.
IT Operations Management suiteIT Incident Management links incidents to the change that caused them, and the review captures root cause and improvement actions, so repeat failures turn into process fixes with owners.
ITSM suiteReport change performance and satisfy control testing
Change volume, success rate and the share of incidents caused by change are read from the records themselves, giving the IT Service Manager a trend rather than a count assembled by hand.
ITSM suiteWho requested, approved, tested and deployed each change is retained with the record, so IT general control testing under SOX or SOC 2 is a report from the system, not a search of mailboxes.
IT Operations Management suiteWhen the approval matrix or release stages change, you adjust the workflow and SLAs yourself, so the practice keeps pace with the organization without waiting on an engineering backlog.
ITSM suiteChange. Runs change requests through risk assessment, CAB approval and scheduling with every change recorded against the services it affects.
Release and deployment. Plans releases with scope, test status, deployment windows and rollback steps tracked.
Incident. Links incidents to the changes that caused them for post-implementation review.
Reporting. Reports change volume, success rate and change-related incidents.
Products this role uses most
Industry reference
ITIL 4's change enablement, release management and deployment management practices define the role; ISO/IEC 20000-1 requires a change management process and COBIT 2019's BAI06 sets the control objective. Change management is an IT general control, so it is tested under SOX, SOC 2 (CC8.1) and ISO/IEC 27001:2022 Annex A 8.32. Financial regulators go further: the FFIEC's Development, Acquisition, and Maintenance booklet (2024) and DORA's ICT change management requirements; HIPAA and FedRAMP expect documented change control for in-scope systems.
Related roles
IT Service Manager
See the roleExplore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
The Change and Release Manager governs every change to production: assessing change risk, routing changes for the right level of approval, running the change advisory board and the change schedule, coordinating release planning, testing and deployment windows, and ensuring every change has a plan, a test and a rollback. They report change success rates and the incidents changes cause. In SmartSuite that practice runs in Change Management and Release Management.
SmartSuite runs each change request through risk assessment, CAB approval and scheduling in Change Management, with every change recorded against the services it affects. The manager sees the change schedule with each item's risk and approval status, so the CAB agenda is the queue itself rather than a list compiled beforehand, and a change to a service with another change already scheduled is visible before it is approved.
Release Management plans each release with its scope, test status, deployment window and rollback steps tracked on the record, so the manager can confirm before the window opens that testing is complete and a rollback exists. Release Management & Planning supports the wider schedule across teams, which is where the DevOps Engineer and Engineering Manager see the windows their work must land in. Nothing goes to production without a plan, a test and a way back.
IT Incident Management links each incident to the change that caused it, which is the input for post-implementation review. The manager can see which changes produced incidents, which types of change or which services fail most often, and bring that evidence to the CAB when setting approval levels. The Incident and Problem Manager works from the same link to see whether a problem traces back to change.
SmartSuite reports change volume, success rate and change-related incidents from the change and incident records, so the manager's report to the IT Service Manager is a view rather than a monthly compilation. The IT Operations Director sees the same figures for the services they run, and because changes are recorded against services, the report can show which services carry the most change risk and where approval levels may need tightening.
SmartSuite is the governance record for change and release, holding the request, the risk assessment, the approval, the window and the rollback plan, while engineering teams keep using their build and deployment tools. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; the first is the change request: load the service list, set risk criteria and approval routes and bring in changes in flight. Change management is an IT general control, so the record also serves the auditors who test it.