• Tight control of access to production systems. Access control is also a key best practice for high-performing IT organizations. This control typically includes clear definition of roles and responsibilities, appropriate segregation of duties, and restricted access to the production environment. Organizations that implement these controls tend to do a better job of limiting process variability and require fewer emergency changes-as well as gaining the benefit of improved IT security and improved compliance with regulatory mandates. Top performers have 60 percent fewer emergency changes than others in these areas.

The study noted that these best practices are ideally adopted in conjunction with each other. Tight control of access to production systems, for example, is itself one of the measures that helps enforce process discipline. But it is also a key component of change and release control. Similarly, standardizing configurations is difficult to achieve without change and release discipline.

ITPI conducted the study in two stages. In the first stage, ITPI interviewed 11 companies widely recognized for their excellence in change, configuration and release management in order to determine what their processes had in common. ITPI then developed a survey based on its findings and, in the second stage of the study, extended that survey to the 341 global IT organizations in its sample set. "Top Performers" in the study represent the top 15th percentile of all participants.