What is current thinking on CAB review for all changes?

[James Murdy]

What is current thinking/practice on CRB/CAB approvals?    

Especially requiring CAB attendance and approval for all production changes?

thanks

[Sean Walters]

Hi James, 

It depends on the organisation. 

But the ideal process would be the following. 

1. Not all changes require CAB any low risk change can be approved by the assignment group during Assess stage and then okay to go ahead to scheduled. (There is a CAB Required boolean flag OOTB)
2. Changes that are low code and are commonly implemented would be proposed as a Standard Change , so going forward those types of changes do not need approval and can get to implementation stage much quicker. 
3. Changes that are high risk/impacting several risks would be required to discuss at CAB. 

That would be the ideal - on the other hand I have also seen all changes go to CAB (except for standard). 

Hope that helps. 

Please mark my answer correct and helpful if this resolves your issue.

[James Murdy]

thanks Sean

for your first level,  do you keep approval at technical  (ITMGR) or tech and business (FBO)?

any thoughts on using the risk assessment question and dynamically determining approval flow?

jim

[Sean Walters]

Hi James, 

So what I have seen mostly in my experience is the first approval is at the assess stage and that is mostly a technical review. 

Usually a member in the assignment group that is not the assigned to - ensuring that the change record is up to standard. 

Secondly you would get the business approval directly at the authorise stage (this could be during a CAB or just adhoc depending on the process). 

Any additional approvals would normally be in between the tech and business. 

In Summary:
Assess Stage: 1st approval (Technical / Member of assignment group)
Additional Approvals: Generated after first approval , may go to another group depending on any additional factors such as critical service, location etc 
Business Approval: Authorise stage - basically the approval to go ahead , and so should be the final approval. 

For your second question, I believe it is okay to drive approvals from answers to your risk assessments. But in my experience those answers should drive data on the change form - and those values should then drive additional approvals if required. 

For example - if a user has put on the risk assessment that this will affect 10000 users , therefore by doing this , this has made the change of High risk. 

Instead of doing a trigger where , where if the question is 10000 users then add an additional approval group, do it by the fact that risk = high and thus additional approval. 

It is more scalable and you can manage it better. 

I hope that makes sense. 

Please mark my answer correct and helpful if this resolves your issue.