In brief
- Change is inevitable in the IT environment, how you react and deal with changes is something you take complete control of
- Setting up a change advisory board (CAB) means including business leaders and frontline IT professionals to manage your IT risks, feasibility, disruptions and impacts in a consistent and coherent manner
- Your CAB can meet as regularly as required, document each process, communicate across the organization to keep everyone on the same page and apply the company’s standards and goals across IT changes
- With clearly defined roles and procedures, worrying about what your next change or any external impact might have on your organization will be a thing of the past
Change is the only constant when it comes to IT systems. Technologies once considered modern become legacy. New cybersecurity vulnerabilities arise every day, and users’ expectations never cease to evolve.
So, the question isn’t, “Should we implement changes to our systems?” — it’s, “How do we introduce them in the most efficient way possible with as little disruption to business processes?”
This is where a change advisory board (CAB) comes in. As a part of IT service management, this group of subject matter experts evaluate normal and emergency change requests for business impact, keep risks in check, and schedules and prioritizes changes.
Here’s everything you need to know about a change advisory board, from its composition and responsibilities to the modalities of CAB meetings and the best practices for setting one up.
What is a change advisory board (CAB)?
A change advisory board (CAB) is a group of business leaders and IT professionals that oversee the change management process enterprise wide. While not every organization requires one, a change advisory board offers a holistic view of change requests, including the associated business risks, technical feasibility, and potential disruptions to and impacts on critical business tasks.
A change advisory board, however, shouldn’t become a gatekeeper. Its role is to provide guidance to change management teams and ensure that any proposed changes are in line with business strategy. In the IT service management framework, it functions as the change authority to evaluate and endorse continuous improvement initiatives across the organization.
Who should be on a change advisory board (CAB)?
A change advisory board (CAB) consists of a chairperson (i.e., the change manager), who is also a CAB member, and subject matter experts (other CAB members). While there’s no one-size-fits-all list of CAB members that should be on a change advisory board, the team should combine input from both senior management and frontline IT professionals to be effective.
That said, CAB members typically include:
- Change manager. As the chairperson of the change advisory board, only the change manager has the final say in all board decisions. The change manager is also tasked with facilitating CAB meetings and communicating on its behalf.
- Service desk analyst. Service desk analysts are at the frontline of technical issues within an organization as they assist users in day-to-day troubleshooting. A service desk analyst also documents those issues and reports them to the service desk manager.
- Operations manager. Operations managers oversee the day-to-day operations of organizations, making them qualified to assess the impact of proposed changes on routine business processes.
- Application manager/engineer. Application managers/engineers oversee an organization’s digital solutions throughout their development life cycle. They contribute a high-level knowledge of the applications and systems.
- Information security officer. Information security officers handle day to day network security and can weigh in on vulnerabilities and security risks.
- Senior network administrator. Senior network administrators or engineers oversee the company’s networks and cloud infrastructures and offer a more global view of these.
- Business relationship manager. Business relationship managers work directly with customers, giving them first-hand knowledge of their expectations and needs. They can contribute to anything related to customer experience.
What changes should the change advisory board (CAB) deal with?
There are three types of changes in the change management process: standard, normal, and emergency changes. Under the IT service management framework, a change advisory board (CAB) typically evaluates only normal and emergency changes.
Standard changes
These changes are mundane and come with a low risk to the company. They rely on pre-approved, standardized, well-documented processes, to reduce risk. Therefore, a change advisory board doesn’t need to review and approve them again.
Examples: adding storage to a server; creating a new database instance.
Normal changes
Such changes aren’t urgent, but there is no pre-approved playbook for implementation (unlike standard changes). They also come with a higher overall company risk. These are the changes that the change advisory board is meant to evaluate for impact, feasibility, and risk.
Examples: adding new features to a product; changing the data warehouse solution; implementing performance improvements.
Emergency changes
In the case of an emergency change request, an emergency change advisory board is convened. An emergency change advisory board is a subset of CAB members that can meet ad hoc to discuss emergency changes.
Emergency changes become necessary because of an unexpected threat, vulnerability, or error that must be handled immediately.
Examples: pushing a security patch; managing a server outage.
Why do you need a change advisory board?
As the body that oversees the change process, a change advisory board is crucial for:
- Reducing risks. The change advisory board can approach risk assessment more holistically than separate teams, reducing overall company risk during the change management process.
- Maximizing change impact. The change advisory board’s feasibility assessments and implementation recommendations make changes more impactful and prevent low-impact or unfeasible changes.
- Ensuring change process efficiency. The change advisory board puts in place knowledge management practices and enables tracking changes across the organization. It also reviews changes to minimize service delivery disruptions and ensure that any changes in the IT environment run smoothly.
- Ensuring alignment with corporate goals and standards. One of its responsibilities is verifying the proposed changes align with existing strategies and architectural standards, ensuring consistent service delivery and quality.
- Prioritizing changes holistically. A holistic approach helps to ensure that the book of work is aligned with company goals and is aimed toward resolving the most critical blockers.
What is a change advisory board (CAB) responsible for?
A change advisory board (CAB) typically takes on the following six responsibilities.
Change evaluation
The change advisory board reviews every proposed change to ensure it is feasible, will deliver the expected results, and won’t have any unintended negative consequences. The CAB members also verify that the proposed change aligns with the business strategy and existing best practices and can draw up recommendations on improving and implementing the change.
Risk assessment
CAB members review every proposed change to pinpoint its potential for disrupting operations, as well as any vulnerabilities or threats that it may entail.
The change advisory board assesses risks from multiple standpoints, such as network security, operations, customer experience, etc. It then designs and puts appropriate mitigation strategies in place to manage identified risks.
Change proposals
In certain cases, the change advisory board can also prepare change proposals. For example, its members may agree on the necessity to improve a specific aspect of service management or implement a performance improvement.
Knowledge management and change monitoring
The change advisory board ensures that all changes are properly documented, typically by leveraging change management software. It also uses change management software to track change requests, approval status, and progress for approved changes.
Communication
The change advisory board doesn’t work in isolation from the rest of the organization. After every meeting, it brings key stakeholders up to speed on its decisions. It should also proactively make sure that change management practices and standards are followed enterprise wide. It is essential to communicate change plans and schedules to all relevant stakeholders, including IT staff, business units, and end-users.
Change management improvement
The change advisory board reviews the current change management processes and can refine them in iterations to improve their reliability and to streamline them. To that end, CAB members typically review change successes and failures, along with metrics, to pinpoint areas of improvement. Post-production reviews and lessons learned will be a foundation for the future success of the IT-organization.
How does a usual CAB meeting go?
A change advisory board (CAB) may meet once a week or more frequently, depending on the organization’s needs. Likewise, in some organizations, bimonthly or monthly meetings may be a better choice.
A change advisory board meeting should bring together all the CAB members, led by the change manager, as well as representatives of teams affected by any proposed changes. The agenda of a CAB meeting typically includes:
- High-risk and marked as required changes
- Failed and backout change review
- Change management process updates
- Proposed change review
Every proposed change assessment should address:
- Risk-impact assessment from a business standpoint
- Impact on infrastructure and customer service
- Impact on security, resilience, capacity, and performance
- Effect on other software development projects or service delivery within the same IT infrastructure, and impact on other third parties
- Business, IT, and other resources required for the change
- Consequences of not implementing the change
- Potential scheduling conflicts with other changes
- Technical capability assessment
For the meeting to be effective, CAB members should review the changes on the agenda and prepare their assessment and recommendations beforehand.
The change manager is responsible for ensuring attendance and for leading the meeting. It’s also the role of the change manager to communicate the meeting agenda beforehand and its results afterward.
How to set up an effective change advisory board
Here are 10 steps to setting up a change advisory board — and ensuring it becomes a valuable driver of change within your organization.
Define roles and responsibilities
Settle on what you expect from your future CAB members. Document their duties as individuals on the change advisory board (make sure to distinguish between the chairperson and the rest of the board). Define the roles and responsibilities of the change advisory board, and how it fits into your organization structure.
Analyze your resources
Review your current change management capabilities and procedures, as well as human resources. Identify who will be your CAB members and who is the best fit to oversee them as the change manager.
Secure the buy-in
Ensure you have the buy-in for creating the change advisory board from both the business leadership and other stakeholders. To do so, demonstrate the potential benefits of your CAB endeavor.
Bring CAB members on board
Start with the change manager; confirm their involvement and ensure they have a full grasp of their responsibilities. Then, confirm the CAB members and communicate their duties to them, as well.
When selecting CAB members, strive to involve the people close to the changes being deployed. Otherwise, your CAB risks creating a bottleneck in the change management processes.
Define a standard meeting agenda and frequency
Settle on how often the change advisory board should meet up, while also leaving some leeway for changing the meeting frequency based on the organization’s needs. It’s also a good idea to create a template for the meeting agenda to ensure no details are omitted by accident.
Set up meetings
Meetings risk becoming a hurdle if they lack structure or CAB members don’t put in the work beforehand. Therefore, make sure the agenda is communicated well in advance, provide all the relevant materials, together with the agenda, and ensure CAB members do their homework.
Set up the emergency change advisory board
If you plan to send emergency changes to the change advisory board, identify which CAB members will be on the emergency change advisory board. This should be done before the first emergency happens, of course. Define the modalities of communication and meetings in case of emergency changes, as well.
Set up change impact assessment
To ensure no stone is left unturned, the change advisory board needs a comprehensive framework for assessing the impact of the proposed changes . Define it together with the other CAB members to cover everything from network security to customer experience.
Introduce post-implementation reviews
To continuously improve your change management process, the change advisory board should be aware of what works and what doesn’t. This is where post-implementation change reviews come in; they allow the CAB members to learn from both successes and failures.
Track CAB performance with metrics
To know whether your change advisory board is effective, you must define the key performance indicators. Those can include:
- Change acceptance rate
- Time for change approval/rejection
- Change success rate
- Number of CAB meetings
- Number of changes addressed by the CAB
- Severity of the changes
In conclusion
A change advisory board enables a holistic overview of proposed changes in the IT environment, making it crucial to mitigate risks, avoid disruptions to business processes, and to ensure the proposed changes are as impactful as possible. It also ensures that changes align with the organization’s strategies and are not left alone without being effectively managed.
While setting up a change advisory board comes with multiple potential benefits, it could become an additional layer of bureaucracy in decision-making. To prevent it from becoming a roadblock, you must define its scope of responsibilities clearly — and ensure smooth collaboration and communication between the CAB and other stakeholders.
Whether you seek to create a change advisory board or improve the efficiency of your existing one, we can help you set up your change management for success. Get in touch with us to discuss how our advisory services can help you mitigate risks and maximize the ROI of your changes.
Alexander Rubanov
Based in New York, Alex has 20 years of experience in managing complex software delivery projects and programs. At Luxoft he is responsible for delivery across multiple clients, focusing on effective execution and project success. For the past 9 years Alex has concentrated on the Financial Services sector and he holds the CFA Foundation certificate.
