Change Authority, Assessment and Approval Decision-Making
Who authorizes
A change authority is the person or group accountable for authorizing a change. It is a role, not a fixed committee: it can be an individual technical lead, a service owner, a manager, or a group such as a change advisory board (CAB). ITIL 4 deliberately does not mandate a CAB; where one is used, it advises and supports decision-making and its membership flexes with the changes being reviewed. Authority is normally delegated down to the lowest competent level, and the delegation must be documented so that everyone knows who may approve what. Emergency changes are usually authorized by a small, named emergency change authority rather than the full board.
What assessment covers
Assessment answers: what could go wrong, how likely, how bad, who and what is affected, what testing and rollback exist, what the implementation window is, and what dependencies or conflicts exist with other changes. It draws on risk management, service configuration management (CMDB and asset data), problem management (known errors), information security management, and supplier management. The output is a recommendation with a clear risk statement, not a rubber stamp.
Decision-making traps
Distractors commonly: put every change through a CAB; say the CAB authorizes standard changes; treat approval as an IT-only decision when business and supplier stakeholders carry the impact; or confuse the change owner/implementer with the change authority. Another trap is assuming high-risk changes must be rejected - the practice enables change by making risk visible and manageable, adding controls such as phased rollout, enhanced testing or a rollback plan.
Rule of thumb: authorize at the level that owns the risk, and record the delegation. If nobody can name who approved a change, the control has failed even if the change succeeded.