[object Object]

The CAB meets weekly to review 80 changes in two hours, of which 65 are pre-approved standard models that nobody reads. The remaining 15 get less than three minutes each because the queue is long. Change Management on ServiceNow has the right model; teams use the wrong shape of it. The patterns below shift the conversation from “the meeting that approves everything” to “the meeting that catches what mattered.”

Stop Approving Everything

A CAB that reviews every change is a CAB that rubber-stamps. Classify changes explicitly: standard (pre-approved via documented model with success track record), normal (CAB review with risk-tiered routing), emergency (expedited with post-implementation review). Only normal changes need full review and even then, only the higher-risk normal changes need synchronous CAB time.

Change classification:
  Standard  -> auto-approved if model in good standing
  Normal-low -> async approval (Slack/Teams/email)
  Normal-medium -> async with named approvers, escalate on no-response
  Normal-high -> synchronous CAB
  Emergency -> expedited approval, mandatory PIR

Risk and Impact, Quantified

Assign risk and impact scores via a structured questionnaire on the change form, not free-text estimation. Low-risk, low-impact normal changes can auto-route to a peer reviewer instead of full CAB. Define thresholds explicitly and tune quarterly against observed failure rates. The risk score should be auditable — every change ships with the inputs that produced its score so a reviewer can verify the assumptions.

// Risk score on change form
function computeRiskScore(change) {
  var score = 0;
  score += change.cmdb_ci.business_criticality * 2;
  score += change.business_hours_change ? 3 : 0;
  score += change.rollback_tested ? 0 : 5;
  score += (1 - change.requested_by.success_rate_90d) * 10;
  return score;
}

Automated Gating

Wire approvals to real signals: code review status from the version control integration, test pass rate from the CI pipeline, change freeze window check from the schedule, security sign-off for regulated workloads. Manual gates become automatic when the conditions are met. The reviewer’s time should be spent on judgment, not on confirming that an automated check has passed.

Emergency Change Without Chaos

Emergency changes happen — the goal is not to eliminate them but to ensure they get the same post-change review as planned ones. A backlog of unreviewed emergency changes hides problems. Define an emergency change SLA for post-implementation review (within 5 business days) and track adherence as a metric. Repeated emergency-change patterns from the same team or service are a signal that the planning process needs work, not the change process.

Measure Change Success Rate

Track change success rate, unauthorized change count (changes detected in production without a corresponding change record), rollback rate, mean time to implement, and CAB time spent per change. Publish weekly to operations leadership. A 95% change success rate is respectable; dropping below 90% means the process or the testing is broken. Unauthorized changes detected by Discovery or audit are findings, not curiosities.

Common Failure Modes

Standard change models that earned their status years ago and have never been re-validated — a quarterly review of standard model success rates is the safety net; any model with degraded success loses standard status. CAB approval treated as a checkbox rather than a decision — if the synchronous CAB cannot reject a change without political consequences, the gate is theater. Risk scoring tuned once and forgotten — recalibrate against observed failure rates per scoring band.

What Changed in 2026

Now Assist’s change risk insights (where licensed) score changes using language analysis of the description plus historical patterns. Treat the insight as one input alongside the rules-based score, not a replacement. The two scores disagreeing is itself a useful signal — surface both to CAB. Workflow Studio adds named change approval subflows that pin to specific versions, which prevents in-flight approval semantic drift.

Cost Considerations

The savings from automation are not in license cost — they are in reclaimed CAB time and reduced change-related incident time. Quantify both. CAB time saved is hours of senior engineer attention freed for other work; change-related incidents avoided are direct operational savings. The investment in scoring rules, automated gates, and standard model curation pays back in headcount-equivalent hours within a quarter for a typical mid-market deployment.

Implementation Sequence

Establish standard model auto-approval first — biggest CAB time saving, lowest risk. Add risk scoring next, with CAB seeing scores but not yet using them for routing. After three months of score validation, route low-risk normal changes to async approval. Synchronous-CAB-only-for-high-risk is the final state, not the starting point. Trying to deploy the full target model on day one produces a change process the operations team distrusts.

What to do this week: pull last quarter’s CAB-approved changes that failed and bucket by classification — high failure rates in standard or low-risk normal categories indicate the classification rules need tuning before any further automation.

[object Object]
Share