Change Advisory Board

Change Advisory Board
Name	Change Advisory Board
Formation	1990s
Type	Advisory group
Purpose	Change management
Headquarters	International

Change Advisory Board

The Change Advisory Board is a formalized advisory body used in ITIL-aligned information technology organizations, serving as a consultative forum that evaluates proposed changes to information systems, network infrastructure, and enterprise architecture. It emerged alongside frameworks such as COBIT, ISO/IEC 20000, and PRINCE2 and interacts with entities including Service Desk, Configuration Management Database, Enterprise Service Management teams, and vendors like Microsoft, IBM, and Cisco Systems.

Overview

The board functions within organizational structures influenced by ITIL v3, ITIL 4, and standards from AXELOS and ISO/IEC JTC 1, aligning activities with risk registers, business continuity plans, and compliance regimes tied to Sarbanes–Oxley Act, General Data Protection Regulation, and industry-specific regulators such as Financial Conduct Authority and Health and Safety Executive. It draws on inputs from programme offices like Project Management Office and stakeholder groups including Chief Information Officer, Chief Technology Officer, Chief Security Officer, and external auditors from firms such as Deloitte, PwC, and KPMG.

Purpose and Responsibilities

Primary responsibilities include assessing proposed changes from teams such as Development Team, Operations Team, Release Management, and Change Management practitioners, ensuring alignment with strategic initiatives like digital transformation programs led by Accenture or McKinsey & Company. The board evaluates risk and impact across services cataloged in Service Level Agreements and liaises with legal departments handling contracts with providers like Amazon Web Services, Google Cloud, and Oracle Corporation. It also coordinates emergency responses alongside incident responders and disaster recovery units modeled after scenarios in Hurricane Katrina and Iceland eruption 2010-style disruptions.

Membership and Structure

Membership typically includes representatives from stakeholder groups: senior IT leaders such as Vice President of IT, product owners from Agile teams, security leads associated with ISO 27001 implementations, change sponsors from executive committees including Board of Directors members, and vendor account managers from SAP SE or Salesforce. Structures vary: some organizations adopt a standing committee model inspired by corporate governance used by International Organization for Standardization-aligned firms, while others use rotating panels similar to peer-review bodies in World Health Organization advisory groups. Subcommittees may mirror risk committees in financial institutions like JPMorgan Chase or Goldman Sachs.

Processes and Procedures

Procedures follow lifecycle stages parallel to Software Development Life Cycle and DevOps practices: change submission, impact analysis, scheduling, testing, implementation, and post-implementation review. Tools used include ServiceNow, BMC Remedy, JIRA, and Confluence for tracking, while test environments may be provisioned on platforms such as VMware, Kubernetes, or OpenStack. Change windows are coordinated with release schedules of major vendors—Apple Inc. or Samsung Electronics—and with regulatory reporting cycles overseen by bodies like Securities and Exchange Commission and European Banking Authority.

Decision-Making and Authority

Decision-making blends technical review, risk assessment, and business prioritization, often guided by matrices akin to those in COSO frameworks and escalation paths found in IT governance models used by multinational corporations including Unilever and Procter & Gamble. Authority can be delegated to emergency change conveners or retained by executive sponsors such as CEO-level delegates or boards patterned after Enterprise Risk Committees. Outcomes may trigger contractual change notices with suppliers like AT&T or Verizon Communications and require coordination with program management offices engaged with vendors like Capgemini.

Criticisms and Limitations

Critiques mirror those leveled at bureaucratic oversight bodies: assertions of slow decision cycles seen in critiques of Telecommunications Act-era regulations, risks of groupthink as observed in studies of Board of Directors failures, and potential misalignment with agile delivery methods advocated by proponents of Continuous Delivery and Lean transformations. Empirical analyses cite tensions between centralized advisory boards and decentralized teams in organizations such as Netflix and Spotify, and legal scholars note governance complexity reminiscent of debates around Dodd–Frank Wall Street Reform and Consumer Protection Act.

Category:Change management Category:Information technology governance