Benefits of a Change Advisory Board?

[michaelryba]

We are trying to sell the concept of a Change Advisory Board to our client and so I am looking for a few bullet points on what the benefits are of a CAB. I can use benefits from the Change Management process itself but I am looking for something specific to CAB. Any thoughts?

Thank you.

[Shiva Thomas]

Hi Mike,

A change advisory board (CAB) delivers support to a change management team by approving requested changes and assisting in the assessment and prioritization of changes. This body is generally made up of IT and Business representatives that include: a change manager, user managers and groups, technical experts and, possible third parties and customers (if required).^[1]

The CAB members should selectively be chosen to ensure that the requested changes are thoroughly checked and assessed from both a technical and business perspective. The considered change will dictate the required personnel to convene in a CAB meeting. These entities are not required to meet face-to-face on each requested change, but rather use electronic support and communication tools as a medium. It is, however advised that a quarterly meeting is scheduled to review outstanding changes, sign-off on approved changes and discuss any future major changes.

A CAB offers multiple perspectives necessary to ensure proper decision-making. For example, a decision made solely by IT may fail to recognize the concerns of accounting. The CAB is tasked with reviewing and prioritizing requested changes, monitoring the change process and providing managerial feedback.

A CAB is an integral part of a defined change management process designed to balance the need for change with the need to minimize inherent risks. For example, the CAB is responsible for oversight of all changes in the production environment. As such, it has requests coming in from management, customers, users and IT. Plus the changes may involve hardware, software, configuration settings, patches, etc.

This is defined as part of the change control process within ITIL.

The CAB concept can also be used outside of the IT world as the change process at a high level can be applied to any system.

Source: Change advisory board - Wikipedia

https://en.wikipedia.org/wiki/Change_advisory_board#mw-headhttps://en.wikipedia.org/wiki/Change_advisory_board#p-search

Also useful, a short video on Change Management in ServiceNow Demo - YouTube

[randrews]

IMHO the single biggest advantage of a CAB is that when it is well staffed.. meaning the helpdesk control center, network monitoring, and security/infrastructure groups are present there is visibility to changes throughout the organization... when the helpdesk screams no one told us x was going down assuming it was covered in CAB you point them to their cab representative... plus this ensures that individuals with overlapping changes are aware of them...

yes i know that the conflict tab SHOULD show you that.. however quite often they are unaware and simply do not have time to check that.. so at CAB their representative can be sure that no one is trying to patch a server while it is down for upgrades etc.

[Rajesh Mushke]

Hi Mike,

Change Management is a key ITIL Transition stage process and one of the most important processes in service management. The Change Advisory Board (CAB) plays a major role in the initiating phase of change management, so a few more things should be said about it here.

ISO/IEC 20000 is a process-oriented standard and it doesn't mention the CAB role specifically, but it has a set of specific requirements which have to be fulfilled. To define the roles for meeting specific assessment requirements, it is only logical to turn to the ITIL best practices.

Why do we need the CAB?

The Change Management process must have an owner. In ITIL, he/she is called the Change Manager. In smaller organizations, this role can be combined with other non-conflicting roles: Service Manager is a good example. The Change Manager can efficiently handle preapproved and smaller standard changes, no sweat. But, when it comes to assessing, prioritizing, authorizing and scheduling of complex changes with higher impact and risks, a group of competent people is needed. They will attend periodically scheduled meetings, address the proposed changes and review the resolved changes.

Who are the CAB members?

Membership of the CAB can vary with the change complexity, impacted business processes and technology. There are usually a few permanent members, with the Change Manager being the first of them. The next one is the Configuration Manager, the person who knows everything about infrastructure. Others can vary: all IT people competent in the impacted service technology, business representative, vendor representative providing underpinning support to the service, etc. Other usual suspects who can help include:

• Service Desk Manager or Analyst
• Operation Manager
• Application Manager
• Information Security Officer
• Superman (If you can get him, no need to read further.)

In case of an emergency change, a CAB subgroup called the Emergency CAB (ECAB) will be in charge. Remember, in ITIL V2 they were called the emergency committee (CAB/EC).In my opinion, the best place to define the CAB membership is in the Change Management Policy.

How does the CAB operate?

Well, during day-to-day service management the CAB meetings will be scheduled and chaired periodically by the Change Manager. Depending on the organization size and change frequencies, they can be conducted monthly, weekly or daily. Smaller organizations usually can live with a CAB meeting every two weeks, or weekly, to keep the rhythm and flow. I have seen even very large organizations operating smoothly with weekly CAB meetings. A tip: it helps if the change approval cycle is defined as longer than the period between CAB meetings.During the CAB meetings, a typical agenda will look like this:

• Review the minutes from the last meeting
  • Review changes implemented during the previous period
  • Failed changes
  • Backed-out changes
  • Successful changes
  • Incidents resulting from implemented changes
• Review/assessment of proposed Requests For Change (RFCs)
  • Risk and impact in terms of:
    • Service and Service Level impact
    • Capacity and performance
    • Security and compliance
    • Financial
    • Etc.
  • Resources involved
  • RFC prioritization

It might be handy to keep a template in the template database that defines the CAB meeting agenda/meeting minutes specific for the organization's needs.

Conclusion

In case it was not clear from the above, CAB members attend the meetings, and provide advice to the Change Manager. The decision is always up to the Change Manager. Too often I notice the misunderstanding of the CAB acronym as Change APPROVAL Board, as opposed to its actual title of Change ADVISORY Board. The Change Manager is responsible for the change approval, based on all the ADVICE provided by the CAB. That's why the appointment of the members is so important. And I feel it should be defined in the Change Management Policy.

Refer,

https://advisera.com/20000academy/knowledgebase/change-advisory-board-itil-advise-approve/

[nigelharrison]

I have just been asked the same old question "why do we need CAB".... from a non ITIL experienced manager. It made me go hunting and I found this thread and a few others but one I liked with a pragmatic approach to ITIL/AGILE/Lean is this link

https://www.dougtedder.com/2017/07/02/cab-dead-long-live-cab/

It's a good read and I like the following part as it keeps offering some flexibility BUT tempers it with a process

The Modern CAB

Regardless of framework or methodology, the modern CAB must have the following attributes:

• All work must be visible – everyone must be able to view what work is being done and the demand being placed on the IT organization
• Team members must be empowered and self-governing – this is one area where strong management support is critical.  But then those doing the work must take personal accountability for changes being done right the first time.
• The authority for implementing a change must be delegated as close as possible to those making the change.  This means having clearly defined evaluation criteria, and identifying who approves what kinds of changes.
• The CAB must be inclusive, with appropriate representation from all involved – not just developers or IT operations, but also colleagues outside of IT.  In some cases, this means getting suppliers involved too.   But most of all, the right people are involved at the right time.
• Trust – When people who work together trust one another, it enables an atmosphere of collaboration instead of blame.

The relevance of IT is at stake.  IT must work as a single team.   It’s time for the modern CAB.