A nine-person CAB meeting weekly for 60 changes
Halden Water operates a utility billing platform. The change model has two types only: normal and emergency. Around 60 normal RFCs arrive each week, and a single CAB of nine people meets on Tuesdays. Average lead time from submission to approval is 11 days. Roughly 40% of RFCs are deferred each week, most often for missing test evidence or unclear impact. Quorum is frequently lost because two members are field engineers who are often on site. Backout plans are commonly pasted from a template. Last month a team deployed to production on a Thursday without approval because waiting for the next CAB would have missed a regulatory deadline; the change succeeded. The change manager wants the team disciplined for bypassing the process.
1. Is the CAB the bottleneck, or is something upstream? Identify the failure modes the numbers point to and say what each one actually is.
Read the worked answer
The meeting is where the problem becomes visible, not where it originates. Four failure modes are showing:
- No risk categorization. Everything is 'normal', so a nine-person committee spends its scarce attention on low-risk items and has nothing left for the ones that matter. The CAB is performing triage that categorization should have done before the RFC reached it.
- 40% deferral is not a decision. A deferral is a queue transfer that costs a full week and produces no information. The pattern (missing test evidence, unclear impact) says the intake has no 'definition of ready' and the CAB has become a quality-assurance gate for submissions rather than a decision body.
- Authority vested in a body, not roles. Quorum of nine means decisions stop when two field engineers are on site - people who probably should not be deciding most of these changes anyway.
- Copied backout plans. Nobody is reading them, which means the assessment step is ceremonial and the plan does not describe this change.
The undisciplined deployment is a symptom of the same design: when the only legitimate path takes 11 days, a team with a real deadline will route around it. Fixing the categorization and the intake removes the pressure that produced the bypass.
2. Design a decision-rights model to replace the single CAB. Who authorizes what, and on what basis?
Read the worked answer
Decision rights should follow risk and competence, not seniority or committee membership.
- Standard / pre-authorized: low-risk, repeatable, catalogue-defined - no per-instance approval.
- Low-risk normal: peer review plus team lead, asynchronous, same working day. Isolated, reversible, single service.
- Medium-risk normal: service owner plus a technical peer, one business-day SLA, evidence recorded against the change record.
- High-risk normal: CAB, but a small one - three defined roles with named standing alternates, and only for the minority of changes that genuinely need cross-functional judgement: shared infrastructure, customer-facing, regulatory, or irreversible.
- Emergency: on-call authority within a documented scope, retrospective approval within one business day.
Two design rules matter more than the tiers. First, publish the delegation as a change authority matrix with roles, thresholds and alternates, so authority is not personal and does not vanish when someone is on leave. Second, define the risk classification criteria explicitly (blast radius, reversibility, novelty, regulatory exposure) so a change can be routed without a meeting, and so a requester cannot self-select the easy path.
Expect the high-risk CAB to shrink to a handful of items a week. That is the sign it is working, not a sign of lost control.
3. Deferral is the most expensive symptom. What would you change so that an RFC is decided at submission rather than held for a week?
Read the worked answer
Move the quality gate to the front door and make holding an RFC impossible.
At registration, enforce a published intake checklist: impact assessment, test evidence, implementation plan, validation criteria, backout plan, risk classification. An RFC that arrives incomplete is rejected the same day with the specific gap named, not held for Tuesday. That converts a 10–11 day feedback loop into roughly one day for the 40% that are incomplete, and it stops incomplete submissions consuming CAB time.
Record every outcome as one of three states: approved, rejected, or deferred with a named owner and a return date. Never allow an open-ended deferral - it hides the fact that no decision was made.
Track deferral reason codes. If most deferrals are 'missing test evidence', the constraint is the test environment, which is a different practice's problem and needs to be raised there rather than absorbed silently by the change process.
Publish lead time as a distribution (median and 90th percentile) by risk class, not an average, so the long tail stays visible. Then watch the emergency ratio: if it rises after the changes, the normal path is still too slow somewhere, and the fix is another pass at categorization rather than more CAB meetings.