How to optimize your Change Advisory Board for faster IT change management

A Change Advisory Board (CAB) is key in managing IT changes, but let's face it: they can slow down your IT change management process big time. This blog explains how reinventing your Change Advisory Board will speed up your IT change management process without losing control.

Understanding the Change Advisory Board

The Change Advisory Board, generally made up of IT and business representatives, supports the IT change management process by carefully reviewing, approving, and supervising all non-standard IT changes. Its main goal is to ensure that these IT changes align with strategic objectives while minimizing potential risks. Typically acting as a gatekeeper, the CAB investigates proposed changes to assess their priority, feasibility, and potential impact on existing systems.

Why your Change Advisory Board isn't working

Traditional Change Advisory Boards can be somewhat of a double-edged sword. In theory, it’s a great way to control changes in your organization. In practice, it slows down your IT change approval process.

There are plenty of organizations where processing IT changes takes weeks, or even months. In a world where agility and adaptability have become vital for IT organizations, this is unacceptable. But how can you speed up the change approval process without losing control?

Mindset shift: re-evaluating the Change Advisory Board's role

Modernizing the role of the Change Advisory Board will make your IT change management process faster and more agile. But to make this successful, you need to shift your mindset:

Not all changes require CAB evaluation

Not every change requires the scrutiny of a Change Advisory Board. Establishing clear criteria for determining which changes do require a CAB review can already significantly improve efficiency. Typically, high-impact and high-risk changes that could potentially disrupt critical systems or services should be the focus of the Change Advisory Board. On the other hand, more standard changes—those with minimal risk and impact—can and should be evaluated without the Change Advisory Board. By categorizing changes into high, medium, and low impact, organizations can separate the wheat from the chaff and determine which changes are worth the time and effort of your CAB, and which aren't.

Delegating low and medium-impact changes

Delegating low and medium-impact changes to the relevant people or teams can dramatically reduce bottlenecks and encourages agility. This approach speeds up your IT change management process, builds accountability, and helps teams grow. It allows those closest to the changes to act quickly using their expertise, while the Change Advisory Board focuses on high-priority changes.

Introducing the Quick Impact Score

The Quick Impact Score is a structured approach for assessing the impact of proposed changes. By categorizing changes as low, medium, or high impact based on predefined criteria, organizations can streamline decision-making and ensure that only the most critical changes are evaluated by the Change Advisory Board.

A slimmed down version of an impact analysis for non-standard changes, the goal of the Quick Impact Score is to determine if a change request should be approved at all, and if so, by whom.

How to implement the Quick Impact Score

Step 1: Pick your impact criteria

First things first, let's figure out what counts when evaluating the impact of a change. These criteria will give you a clear picture of the change's scope and possible ripple effects.

Examples of impact criteria:

• Number of affected customers: how many people will be affected by the change when something goes wrong? The higher the number, the higher the impact.
• Costs: what costs would be involved to implement the change? The higher the costs, the higher the impact.
• Number of agents involved: how many agents would be involved in realizing the change? The more agents and parties involved, the higher the impact.
• ITSM Cybersecurity: what security risks would this change entail? If the change could pose a security risk, it’s pretty likely you’re dealing with a high-impact change.
• Laws and regulations: would the change in any way affect your compliance to laws and regulations? If the answer’s yes, the change request is probably high-impact.

Step 2: Define impact levels for each criterion

Now that you’ve got your criteria, it’s time to set the stakes. Decide what low, medium, and high impact looks like for each one. For example, a low-impact change might cause minimal disruption and cost next to nothing, whereas a high-impact change could affect a wide customer base or pose significant compliance risks. Differentiating these impact levels helps in making accurate assessments and managing resources efficiently.

Step 3: Determine authorizers for each impact level

With impact levels nailed down, it’s time to determine who will evaluate and authorize low, medium, and high-impact changes. Of course, you’re free to design this however you want, but it's important to balance quality control with speed of decision-making. The trick is to involve only the necessary individuals.

For low-impact changes, you might not need formal approval, allowing teams to forge ahead quickly. Medium-impact changes could require approval from a specific individual, like a change or IT manager, for an extra layer of review. High-impact changes do require the help of the Change Advisory Board.

The Quick Impact Score in practice

Say you want to update a free application such as Notepad++ for the entire organization. This can be done by a single application manager in less than a day and doesn’t pose any security or compliancy issues. So – what does its Quick Impact Score look like?

1. Assess the change request based on your criteria

You assess the criteria as follows:

• Number of affected customers: all employees => high impact
• Costs: free => low impact
• Number of agents involved: 1 => low impact
• Security: no security risks involved => low impact
• Laws & regulations: not applicable

2. The highest score is your impact score

When reviewing the total Quick Impact Score, the impact score of a change request is determined by the highest value–not by an average. In this example, all impact scores are low, except for ‘number of affected customers’, which is high. This means the impact score for this entire change request is high.

3. See if you can lower the impact of your change request

When you have a medium or high-impact change request, the question is: is there anything you can do to lower the impact score?

In the case of updating Notepad++, see if you can decrease the number of customers affected. Perhaps by performing the updates outside of regular working hours. Or by first doing a roll-out in a small test group. If this is successful, you lower the impact of updating the app for the rest of the organization as well.

How the Quick Impact Score affects the Change Advisory Board

When you implement the Quick Impact Score, you typically end up with about 80 percent of all requests being estimated as having low impact, and 10 to 15 percent as having medium impact. This means that your Change Advisory Board would have to process only 5 to 10 percent of the change requests they’re currently handling. Let that sink in for a moment: your Change Advisory Board would have 5 to 10 percent of the workload they have now. How's that for a faster IT change management process?

Overcoming resistance to a modern Change Advisory Board

When moving towards more agile processes, it's essential to bring Change Advisory Board members on board. Their support is key to successful IT change management. But resistance is natural, so how do we address it?

Addressing common objections from Change Advisory Board members

The Change Advisory Board might worry about losing control when the organization shifts to using the Quick Impact Score. It’s important to reassure them that this shift simply refocuses their time and energy to critical, high-impact changes, rather than reducing their control. This approach actually boosts efficiency by keeping the CAB's governance tight on what's actually important, while cutting down delays on processing low-impact changes.

Encouraging a culture of agility and efficiency

To really sell the benefits of working agile, clearly communicate how streamlined processes mean faster approval times and quicker responses to business demands. By emphasizing these time savings, Change Advisory Board members can see how they'll be freed up to tackle more strategic, high-value tasks, increasing their overall contribution to the organization.

Best practices for a more agile Change Advisory Board

To make your Change Advisory Board even more agile, it's important to embrace a few best practices. Streamlining meetings, putting technology to work for you, and nurturing a culture of continuous improvement are all key strategies to consider.

1. Streamlining effective CAB meetings

Effective Change Advisory Board meetings start with a well-thought-out agenda. Ensure that you prioritize high-impact changes when preparing this agenda and distribute it in advance. Keep discussions tight by sticking to essential topics with set time limits, and focus on urgent issues to drive quicker, more decisive outcomes.

2. Leveraging technology and tools

Use the power of technology to boost Change Advisory Board outcomes, for example IT Change Management software that tracks change requests, automates routine steps, and facilitates seamless communication among CAB members.

3. Continuous improvement and feedback loops

Stay agile with continuous improvement. Regularly assess the Change Advisory Board's performance and gather feedback from members. This will help pinpoint areas of improvement, ensuring the management process stays aligned with organizational goals.

What to take away from this blog

Reinventing your Change Advisory Board is key in making your IT change management process faster and more agile. By implementing the Quick Impact Score and fostering a culture that balances quality control with speed of decision-making, your organization can address internal resistance effectively and respond faster to business demands.

To dive deeper into Agile Service Management, check out our guide to Agile Service Management, including:

• How to make your service delivery faster and more flexible
• What Agile, Scrum and Agile Service Management are
• 6 real-life examples of Agile Service Management
• How to make your Incident Management & SLAs more agile
• 7 common pitfalls in agile transitions to avoid