Home » ITIL » ITIL® Change Management – How to Run a Successful CAB

ITIL® Change Management – How to Run a Successful CAB

ITIL® (Information Technology Infrastructure Library®) is an industry acknowledged set of IT Service Management best practices. It promotes a realistic and scalable approach to identifying, planning, delivering and supporting IT services to the business and is comprised of five stages: Service Strategy, Service Design, Service Transition, Service Operation and Continual Service Improvement.

What is IT Change Management?

IT Change Management is a key process within the Service Transition stage. The Change Management process uses standardized procedures to handle IT Changes efficiently while keeping disruption to the business to a minimum. When implemented, ITIL Change Management results in a demonstrable improvement in service availability, greater productivity, enhanced business perception of IT, and increased customer satisfaction.

What is the CAB?

The Change Advisory Board (CAB) is an integral part of the Change Management process. The CAB is a cross functional group, which actively supports the Change Manager in the assessment, prioritization, scheduling and approval of all IT Changes.

Running a CAB for Optimum Results

CAB Attendees

ITIL recommends that the CAB includes representatives from all areas within the IT Service Provider, Business, Third Party Supplier and, where appropriate, Customer communities. This allows the CAB to thoroughly check and rigorously assess the impact of Changes from both a technical and business perspective. It is the responsibility of the IT Change Manager, who chairs and facilitates the CAB, to make sure that the appropriate decision makers are invited and that if they are unable to attend, they send a suitable representative.


ITIL advocates operating the CAB on a regular basis. Just how frequently depends largely on the size and maturity of each organization, but it usually varies from weekly to quarterly. These days, the meeting is just as likely to take place via audio/video conference as a face-to-face meeting.


Requests for Change (RFCs) are circulated to CAB members for review prior to every meeting. The focus tends to be on RFCs that will have a wide scale or significant impact to the organization.  Those Changes that are defined as ‘low risk’ or ‘routine’ are often excluded from the agenda.

The CAB typically performs some or all of the following activities:

  • A review and assessment of proposed RFCs
  • A review of failed Changes
  • A review of rolled back Changes
  • A review of implemented Changes
  • A periodic review of the Change Management process itself

This encourages CAB members to focus on lessons learned and fosters a culture of continual service improvement.

Approving RFCs

The CAB must take into account all of the following before giving technical, business, financial and third party supplier approval:

  • Risk / impact to the business (including the accuracy of the initial Change priority assessment)
  • Impact of the Change upon the wider infrastructure and other services
  • Impact of the Change upon customer service and Service Level Agreements (SLAs)
  • Impact of the Change upon capacity and performance
  • Impact of the Change upon security and compliance
  • Impact of the Change upon contingency / Disaster Recovery plans
  • The IT and business resources required to implement and support the Change
  • Risk / impact of not implementing the Change (business justification)
  • Potential conflict with other Changes or scheduled maintenance
  • Back out plan
  • Test results (including User Acceptance Testing)

If the CAB rejects a Change, the Change Manager will document the reasons for rejection and communicate this to the Change Requester.

Emergency Change Advisory Board

ITIL methodology recognizes that IT processes need to be agile enough to meet the demands of modern business. The ITIL Change Management process therefore incorporates an Emergency Change procedure, which can be only invoked when a Change is required to fix a high severity IT Incident that is having a major impact on business operations. As Emergency Changes require rapid implementation, they can be approved by the ECAB (Emergency Change Advisory Board): a small subset of the CAB empowered to make an immediate approval decision.


About this author:

Angel Prusinowski

Angel is a leading ITIL® instructor at Ashford Global IT.

Leave a Reply

Your email address will not be published. Required fields are marked *


This site uses Akismet to reduce spam. Learn how your comment data is processed.