A CAB that does not become a bottleneck

A change advisory board exists to support good authorisation decisions. It fails when it becomes the only path for every change, regardless of risk.

Why it matters

When CAB is a bottleneck, two things happen. Delivery finds unofficial routes, which means risk goes invisible. Or everything waits for the next meeting, which means the calendar—not the service—sets the pace.

Neither outcome is governance. Governance is proportionate control: more scrutiny where impact is high, lighter paths where the pattern is proven.

How I keep CAB useful

Route work by change type. Standard changes follow their procedure. Low-risk normal changes can be assessed by the change manager with the right technical reviewers. CAB time is reserved for higher risk, cross-service, or poorly understood changes.

Send packs early. Advisors cannot advise on a title and a hope. They need impact, test evidence, back-out plan, and who is on support after go-live.

Keep the meeting short and decisive. The question is whether risk is understood and accepted, not whether every slide looks polished.

Record the advice and the authorisation decision. Attendance is not the same as approval.

What good looks like

People know which changes need CAB and which do not. The rules are written and applied consistently.

Emergency changes are authorised quickly by the appropriate authority, then reviewed afterwards. They do not pretend to have had a full CAB in the middle of an outage.

Metrics show lead time by change type. If normal low-risk work is stuck behind board dates, the model needs adjusting.

CAB discussions change outcomes: scope reduced, extra testing added, or a window moved. Rubber stamps waste everyone’s time.

Common mistakes

Using CAB as a status meeting for projects.

Requiring the full board for routine work because “that is how we have always done it.”

Confusing a crowded invite list with better risk management.

Skipping post-implementation review on failed or emergency changes. Learning is part of the control.

Takeaway

Put CAB where judgement adds value. Match the path to the risk, prepare the evidence, and let predictable work move without waiting for a weekly gate.