Linking Configuration Data to Change and Audit

Configuration data should be linked to change and audit so that change impact assessment, incident diagnosis and audit feedback continuously test and improve it. Treated this way, configuration information becomes a decision asset whose scope and detail are justified by the incident, change, risk and service questions it helps people answer.

• Use configuration relationships in change assessment, starting with one priority service and expanding only when the approach is credible.
• Update configuration records through controlled change, and audit them against physical and logical reality. Where ownership crosses boundaries, put audit on the shared agenda and keep the resulting commitment visible.
• Resolve discrepancies by risk. In the article's example, a post-change discrepancy reveals an undocumented dependency and triggers both a data correction and a process improvement.
• Measure the share of change records that update configuration, impact prediction accuracy and audit discrepancy age. Read them as a set and agree which management decision a movement in each should trigger.
• Avoid treating the CMDB as a static inventory, auditing without correction, and allowing emergency changes to bypass updates permanently. Evidence of each risk should lead to an owner and a proportionate action, not merely another note in a report.