2. The Change Advisory Board Is Not the Decision Maker
For years, the Change Advisory Board or CAB has been a familiar part of ITSM.
A group of people meet
Changes are reviewed
Questions are asked
Risks are discussed
Approvals are given
It sounds sensible, but there's a question worth asking: Does your CAB actually enable better decisions, or has it simply become another approval meeting?
The CAB problem
The problem isn't CAB itself. The problem is what we sometimes expect CAB to do.
A CAB should provide a mechanism for collaboration, advice and risk visibility.
It shouldn't necessarily be the organisation's universal change approval authority. Yet in many organisations, almost every change finds its way to the same meeting. A routine infrastructure change sits beside a major business transformation. A repeatable, proven change receives the same attention as something nobody has ever attempted before.
And valuable people's time gets spent reviewing changes that carry very little risk. That's not effective governance.
Not every change deserves a meeting
Imagine a team has successfully deployed the same configuration change 150 times.
It has:
A documented procedure
Automated testing
A known implementation method
A tested rollback
Monitoring
A very low failure rate
Why would change number 151 need to go through the same decision process as a completely new and high-risk change? It probably shouldn't. The organisation has already learned something from the first 150. Good Change Enablement should use that learning.
Move from approval to confidence
One of the biggest opportunities for modern Change Enablement is moving away from: “Who approved this?” towards: “Why are we confident this change is safe and appropriate?”
That confidence can come from different places.
Sometimes it's human expertise.
Sometimes it's historical data.
Sometimes it's automation.
Sometimes it's a standard change model.
Sometimes it's a combination of all four.
The important thing is that governance becomes proportional to risk.
What could replace the traditional CAB model?
Not necessarily eliminate CAB. Instead, evolve it.
For example:
Standard changes: Pre-approved based on proven success and clearly defined boundaries.
Low-risk normal changes: Lightweight approval, potentially delegated to the delivery team.
High-risk changes: Targeted review involving the people with the appropriate expertise and accountability.
Major changes: Cross-functional assessment involving business, technology, security, operations and other relevant stakeholders.
Emergency changes: Rapid decision-making with retrospective review.
This is much more dynamic than putting everything into one weekly meeting.
CAB can become a centre of learning
There is another opportunity here. Instead of spending the majority of CAB time asking:
“Is this change okay?” CAB could spend more time asking: “What are we learning from our changes?”
Which changes are failing?
Where are incidents occurring after implementation?
Which teams have unusually high change failure rates?
Which changes should become standard?
Where are dependencies causing repeated problems?
Are emergency changes increasing?
Are we seeing changes that repeatedly cause customer impact?
That is far more valuable than reading a list of change tickets.
A practical CAB health check
Ask your CAB:
How many changes do we review each month?
How many genuinely require CAB discussion?
How many are repeatable?
How many could be automated?
How often do CAB discussions actually change the decision?
What percentage of meeting time is spent on low-risk changes?
What improvements have resulted from CAB insights?
If the answer to the last question is “not many”, you may have an approval forum rather than a governance capability.
The uncomfortable question
If a CAB disappeared tomorrow, would your organisation become more risky? If the answer is immediately “yes”, ask yourself why.
If all the organisation's change knowledge and risk management depends on a weekly meeting of a handful of people, that's potentially a bigger problem.
Good Change Enablement should build organisational confidence and capability, not dependency on a committee.
The future of CAB isn't necessarily no CAB. It is the right CAB, for the right changes, at the right time.
Next in the series: Standard Changes: Stop Asking for Permission to Do the Obvious
Change Enablement - Beyond the Change Ticket.
Comments