Change-advisory board

A change-advisory board (CAB) delivers support to a change-management team by advising on requested changes, assisting in the assessment and prioritization of changes. This body is generally made up of IT and Business representatives that include: a change manager, user managers and groups, product owners, technical experts, and possible third parties and customers (if required).

Membership

The CAB members should selectively be chosen to ensure that the requested changes are thoroughly checked and assessed from both a technical and business perspective. The considered change will dictate the required personnel to convene in a CAB meeting. These entities are not required to meet face-to-face on each requested change, but rather use electronic support and communication tools as a medium. It is however advised that a quarterly meeting is scheduled to review outstanding changes, sign off on approved changes and discuss any future major changes.

A CAB offers multiple perspectives necessary to ensure proper decision-making. For example, a decision made solely by IT may fail to recognize the concerns of accounting. The CAB is tasked with reviewing and prioritizing requested changes, monitoring the change process and providing managerial feedback.

Role

A CAB is an integral part of a defined change-management process designed to balance the need for change with the need to minimize inherent risks. For example, the CAB is responsible for oversight of all changes in the production environment. As such, it has requests coming in from management, customers, users and IT. Plus the changes may involve hardware, software, configuration settings, patches, etc.

This is defined as part of the change control process within ITIL.

The CAB concept can also be used outside of the IT world as the change process at a high level can be applied to any system.

Emergency Change Advisory Board (ECAB)

In ITIL if an incident demands an emergency change, selected members of the above Change Advisory Board come together and decide. Their composition and particular authority is defined before it comes to action within the change process.

Criticism

DevOps practitioners have criticized CABs as slow and ineffective. In Accelerate, based on analyzing several years of research, Nicole Forsgren, Gene Kim, and Jez Humble conclude that:

External approvals were negatively correlated with lead time, deployment frequency, and restore time, and had no correlation with change fail rate. In short, approval by an external body (such as a manager or CAB) simply doesn’t work to increase the stability of production systems, measured by the time to restore service and change fail rate. However, it certainly slows things down. It is, in fact, worse than having no change approval process at all.

See also

• ITIL