Navigating Through Change: Lessons for the Proactive Manager

What do Socrates, Ben Franklin, and Bob Dylan all have in common? They recognized the need to embrace change!

With planned change, risks can be more easily anticipated and mitigating controls put in place. An example of planned change is the implementation of Project One. To learn more about these exciting changes check out the Q&A with Chris Carrol (Executive Director of Project One) and Paul Raknes (Change Lead, Enterprise Program Management Office). Other change is reactive but still requires controls to address risk. While rapidly changing conditions make it difficult to anticipate every risk, remaining agile and adaptable helps us respond quickly and more effectively to mitigate the impact of risk occurrences.

Our last newsletter provided guidance on planning for known risks (known knowns) and anticipating the unknown (unknown unknowns). Building on those ideas, this newsletter will help the proactive manager navigate situations involving both planned and reactive change.

• Q&A with Chris Carroll (Executive Director for Project One) and Paul Raknes (Change Lead, Enterprise Program Management Office)
• Strategies for Managing Change
• Control Mapping for Better Change Implementation
• Resources for Understanding Federal Changes
• Strategies for Managing System Updates
• Change Resilience

Q&A with Chris Carroll (Executive Director for Project One) and Paul Raknes (Change Lead, Enterprise Program Management Office)

As part of ongoing Q&A with leadership, we spoke with Chris Carroll (Executive Director for Project One) and Paul Raknes (Change Lead, Enterprise Program Management Office) for an update on Project One and insights on change. Below is an excerpt from the Q&A – for additional Q&A responses, click here.

Q: What is Project One and what key changes are anticipated for UCSF?

A: Project One is a multi-year, enterprise-wide, business transformation effort to implement Oracle Cloud ERP for HR, Finance, Supply Chain, and Sponsored Research. Currently, we use a wide variety of systems to support these business functions. In some cases, Health and Campus or School/Departments use different systems for the same function. The goal is to standardize, where possible, maximizing use of Oracle ERP to reduce the total system footprint.

One key change that will impact staff is in procurement. Today, we use BearBuy (campus) and Allscripts (Health), among other tools, for managing the requisition and approval for purchase of goods and services. In the future, we will only use Oracle Supply Chain Management.

Q: What are some differences between managing planned vs. reactive change?

A: With Project One, we plan for the known with the flexibility to react to the unknown, relying on our guiding principles to help us make the best decisions with the information available. Tactically, we use a RAID Log (risks, actions, issues, and decisions) to monitor and manage both the known and unknown.  Planned change has luxuries that reactive change does not. You have the time to define a robust case for change, identify, onboard and align sponsors around a future vision and take the time to assemble the appropriate team necessary to inform the new solution thereby ensuring buy-in and ownership. 

With unplanned change, we must establish a culture of change and be change capable. This occurs only after prior successful planned initiatives in which people lead with confidence, communicate transparently, build a compelling/resonant case and honestly assess the impact of the change. Change capable leaders should avoid over promising on the new solution, involve stakeholders in defining the new solution, show emotional maturity & empathy with those affected by the change and avoid change saturation. If employees trust leaders to help them navigate planned changes, they will also follow in times of unplanned change. They will be familiar with and consequently more comfortable embracing newness even when unforeseen.

Q:  What is the attitude towards change at UCSF?

A: Overall, we are open to change but the journey to absorb the impact varies. The transition from the old way of doing something to the new is informed by individual and shared experience of previous change, local culture, change fatigue, leadership and other factors, all of which determine how receptive or resistant an individual or team will be to new change.  Much of the resistance to change originates from stewardship of the institution and a want to protect the institution from something that might hurt one or more of our missions. This results in errors like not building a solid case for change, not ensuring appropriate business involvement in defining the new solution or leaders not showing confidence & enthusiasm for the change.

Well defined business drivers, clear and aligned sponsorship, opportunity to inform the design and build of the new solution and timely/targeted communication outlining meaningful change impacts will all contribute to reduced anxiety around the change and lower resistance.

Q: How does mapping risks and identifying control gaps impact effective change?

A: Replacing over 50 localized systems, processes, policies, procedures and controls with one standardized solution will result in a changed risk profile. Controls with existing systems are dated and inconsistently applied across the enterprise. Regarding access controls with the new system, there will be significant risk reduction because, unlike many of the existing systems (where people are often afforded system access to everything except that which segregation of duties prohibits), Oracle starts with zero system access and only allows that access defined by a considered delegation of duties. 

The work done to map system access to individual users is aligned with the effort to map users to training and specific elements of the communication plan. This work is coordinated by the Change Management team in conjunction with the business process and technical teams.

Q: What advice can you offer those facing challenges managing change in their organizations?

 A: Know what is critical and ensure your teams are driving toward those same priorities. Change needs to be led – leaders at all levels in an organization are accountable for leading change. The easiest way to keep leaders engaged and focused is to clearly outline business outcomes or benefits and holding the leaders accountable for delivering the outcomes.

For more information on how work will change at UCSF and guiding principles for Project One, check out the following links: https://one.ucsf.edu/ and https://one.ucsf.edu/guiding-principles

<<Back to Top

Strategies for Managing Change

Managing change effectively requires a multifaceted approach. Here are five strategies to help manage change with confidence. These not only protect against risks, like fraud, but also facilitate the safe transition of new systems or restructured team, thereby securing your long-term business continuity and operational integrity.

• Adopt a Change Management Framework: The Kotter model stresses creating urgency around the need, building a guiding coalition, forming a strategic vision, enlisting a volunteer army of those affected by the change, enabling action by removing barriers, generating short-term wins, sustaining acceleration, and instituting permanent change (www.kotterinc.com/methodology/8 -steps/). The ADKAR model focuses on Awareness, Desire, Knowledge, Ability & Reinforcement to achieve the goal (www.prosci.com/methodology/adkar).
• Reevaluate Controls & Continuous Monitoring: The old controls were designed for the old system, process or staff organization and not the new.
• Cross-departmental collaboration: Identify and involve all stakeholders involved in the change and involve them early in the planning process. This will also help align operational goals with control requirements.
• Training and Communication: Ensure the entire team is trained on the new system or processes and understand the changes to internal controls. Clear documentation and open communication can prevent misuse, oversights and control failures when the change is implemented.

<<Back to Top

Control Mapping for Better Change Implementation

In today’s fast-paced environment, we are frequently confronted with the challenge of change—be it the integration of new systems, staff reorganizations, or evolution of business processes. Managing transitions, while preserving robust internal controls, is a complex task. Three initial steps are:

• Recognize the old controls are designed for the old system, process or structure.
• Perform a full assessment of what controls are needed in the future state.
• Map how to get from the old to the new state to help outline the process for instituting the change and identify control gaps. 

Some of new controls may be obvious, while others may not. Useful questions may be: What risks emerged when others implemented similar change?  What controls worked/didn’t work? How are these conditions different?  For staff reorganization, envision how moving (or eliminating) positions will affect processes in the future state and remember that the same person cannot have two roles in the same financial transaction. Some key considerations to consider are:

• Evaluation of the mapping should be performed before and during the change period, as conditions may change once the transition is initiated (new gaps may emerge).
• Secondary controls may be needed to cover gaps until the new controls are in place.
• Post-implementation, continuous monitoring (where someone makes sure that the new controls do what they were designed to do) is essential.

<<Back to Top

Resources for Understanding Federal Changes

With policy & political landscapes rapidly changing with our ecosystem, understanding and reacting may be difficult. Here are some helpful online resources to keep you informed:

• This UCOP site provides updates on policy developments, official statements, congressional actions, and resources to keep us informed and advocate for protecting UC’s priorities. (https://www.universityofcalifornia.edu/federal-updates)
• UCOP hosts a weekly update/briefing highlighting the latest events and UC actions: (https://www.universityofcalifornia.edu/federal-updates/weekly-federal-update-brief).
• UCSF Office of Research website provides guidance, FAQs and info related to executive orders (https://research.ucsf.edu/impacts-2025-federal-executive-orders-and-directives)
• The Committee on Government Relations (national authority on federal policy & and regulations affecting research universities, medical centers, and independent research institutions) website dedicated to interpreting federal policy, links to resources on Executive Orders, Directives/Memoranda, updates on the lawsuits https://www.cogr.edu/
• The UCSF FSAP program is available for those experiencing change that is affecting their personal or work-life: https://chr.ucla.edu/employee-counseling/coping-with-change

<<Back to Top

Strategies for Managing System Updates

Change is essential for any thriving organization, driving progress and competitiveness. System changes—through new implementations, upgrades, or modifications—enhance operational efficiency, adapt to compliance needs, and solve problems. However, these changes can introduce significant risks if not managed properly.

Inadequate change management can lead to data breaches, operational disruptions, poor decision-making, and reputational or financial damage. To ensure smooth transitions during system changes, it is crucial to be vigilant and proactive. Here are key risks & and strategies:

Confidentiality Risks: System changes can lead to unauthorized access or accidental data disclosure. Mitigation Strategies:

• Conduct thorough security risk assessments.
• Implement robust security controls and regular updates.
• Ensure comprehensive data governance policies.
• Provide security best practices training.

Integrity Risks: Changes can compromise data integrity, resulting in inaccurate or unreliable information. Mitigation Strategies:

• Establish stringent data mapping and cleansing processes.
• Perform rigorous testing and validation of changes.
• Implement version control.
• Offer training on data integrity and quality assurance.

Availability Risks: System changes can cause system outages or data loss. Mitigation Strategies:

• Conduct detailed risk assessments before changes.
• Test and validate changes in a controlled environment.
• Ensure redundancy and failover mechanisms.
• Regularly back up data and maintain retention policies.
• Develop and maintain disaster recovery (DR) and business continuity plans (BCP).
• Provide training on DR and BCP for staff preparedness.
• Maintain comprehensive documentation of DR and BCP procedures.
• Establish monitoring and alerting systems to quickly address issues.

System changes offer opportunities for growth and improvement but pose significant risks if not managed correctly. By understanding these risks and implementing robust change management controls, we can ensure that system changes lead to positive outcomes. Stay vigilant, stay informed, and embrace the journey of change with confidence, knowing that with the right strategies and safeguards in place, your organization can navigate the rapids and emerge stronger and more competitive.

<<Back to Top

Change Resilience

In the ever-evolving environment in which UCSF operates, the ability to navigate unforeseen changes is crucial. Here, we share key strategies to mitigate the risks associated with unplanned changes and some examples taken from the recent COVID-19 pandemic.

Embrace Change: Accept that change is an inevitable part of life and work. Viewing change as an opportunity for growth rather than a threat can help teams remain open and adaptable.

• Example: UCSF quickly expanded its telemedicine capabilities to ensure continuity of care while minimizing the risk of infection. This included virtual consultations, remote patient monitoring, and digital health tools.

Strengthen Communication: Clear and concise exchange of information, coupled with active listening, helps keep stakeholders informed and engaged. Develop clear and concise communication skills to express your ideas and concerns effectively. Practice active listening to understand others’ perspectives and gather valuable information. This collaborative approach facilitates quicker and more effective responses to emerging risks.

• Example: UCSF maintained clear and consistent communication with staff, patients, and the public through regular updates, town halls, and transparent reporting of COVID-19 data and policies.

Foster a Supportive Network: Building strong professional relationships within and outside UCSF creates a robust support system. Encouraging teamwork and collaboration harnesses diverse perspectives and expertise, enhancing our collective ability to respond to changes.

• Example: UCSF formed interdisciplinary task forces that included experts from infectious diseases, emergency medicine, public health, facilities, and other fields to develop and implement comprehensive response strategies.

Stay Informed: Keep up-to-date with industry trends, market conditions, and broader societal shifts that may signal change. Staying informed about industry trends and establishing feedback loops allows UCSF to adapt swiftly based on new information.

<<Back to Top