An enterprise change advisory process conflicts with continuous delivery. How can both requirements be met?

The underlying requirement

The change process exists to ensure changes are authorised, assessed for risk, reversible, and evidenced. Those are legitimate requirements. What is negotiable is that they are met by a weekly board reviewing tickets.

How continuous delivery meets them better

Authorised — every change traces to a reviewed, approved merge with attribution, which is stronger evidence than a ticket someone raised.

Risk-assessed — automated policy checks evaluate every change consistently, where a board samples and relies on the requester's description.

Reversible — automated rollback, exercised on every deployment, versus a documented back-out plan that has never been executed.

Evidenced — a complete, tamper-evident record of what changed, when, by whom, with test results and approvals attached, produced automatically rather than assembled for an audit.

A pipeline produces continuous, complete evidence; a board produces periodic, sampled evidence. Making that argument with the artefacts in hand is what allows the process to change.

The practical arrangement

1. Risk classification, automated. Most changes are standard — low risk, well-understood, automatically approved by policy. A small set are significant and receive human review. Classification by change characteristics rather than by ticket type is what makes the volume manageable.

2. Pre-approval of the process, not each change. The board approves that a pipeline with these controls may deploy this class of change, and audits the pipeline rather than each instance.

3. Manual review for the genuinely significant — irreversible migrations, changes during a peak period, changes with customer-visible behaviour requiring coordination.

4. Evidence generated automatically and retained, so the audit is a query.

The cultural obstacle

The board's role is being redefined, and that is a legitimate concern for the people in it. The productive framing is that the board moves from reviewing individual changes to owning the controls the pipeline enforces — designing the policy, auditing its operation, and handling the exceptions.

That is a more valuable role and a more defensible one, and presenting it that way is usually what makes the change possible.