A regulated business releases every two weeks through a change advisory board. Engineering wants continuous deployment. The control is real: an auditor tests that every production change was authorised, risk-assessed, tested and reversible. Sequence the migration.

The sequence, each step reversible

1. Write down what the control asserts, not what the board does. Almost always: the change was authorised, its risk was assessed, it was tested, it can be reversed, and the person who approved it is not the person who wrote it. That list is the whole migration. Everything else is an argument about which mechanism produces that evidence, and mechanisms are negotiable in a way that controls are not.

2. Generate the evidence from the pipeline, while nothing else changes. Every release still goes to the board, but the change record is produced automatically: commit, approvers, test results, artefact digest, the rollback command and proof it was exercised. You have not touched the control; you have changed where its evidence comes from. Reversal is turning the generator off. This step alone usually removes most of the board's actual work, which is how you acquire an ally.

3. Define a pre-authorised standard change category. Most control frameworks already contain one: a class of change that is low-risk, repeatable and automatically verifiable, approved once as a category rather than each time. In practice this is the step that costs the most calendar time and the least engineering effort. Define membership by criteria the pipeline can evaluate without a human: no schema change, no change to authentication or permissions, behind a flag, canary gate passed, rollback tested in this pipeline run.

4. Run both paths in parallel for a quarter and measure. Standard changes deploy continuously; everything else goes to the board. Compare change failure rate and recovery time between the two classes. This is the practical point of no return — not technically, because step 3 is still reversible, but politically: once the data exists, the conversation is about evidence rather than comfort.

5. Widen the category by evidence, and keep a real board for the rest. Schema changes, permission changes and anything that moves money stay with a human assessment. That residue is typically under 10% of changes, and the board does better work on it than it ever did on 40 routine deploys a fortnight, because attention is finite and it was being spent on the wrong changes.

Where reality can diverge from the record

The audit finding that ends this programme is a production change with no corresponding record: a manual hotfix, a console toggle, a configuration edit through a vendor UI. Before step 3, close the console. Every path into production must produce a record or be removed, and the only way to know is to reconcile deploy events against change records continuously and alert on the difference.

The rollback at each stage

Steps 1 and 2 leave the existing control fully intact. Step 3 is a configuration change that can be withdrawn in an afternoon. Step 4 is deliberately dual-running. There is no stage where retreating means re-implementing something, which is why this sequence survives a change of sponsor. Prefer this order to any plan whose first step is running something new in production.

How long it really takes

Two to four quarters, or roughly 180 to 365 days, and the long pole is not the pipeline. It is the auditor's and the risk function's confidence, which is bought with the parallel-run data from step 4 and cannot be bought earlier.

When this is the wrong answer

Do not ask for an exemption from the control. It converts a tractable engineering problem into a compliance dispute you will lose, and it teaches the risk function that engineering wants less assurance rather than better assurance.

And where the blast radius is genuinely unbounded and irreversible — firmware pushed to devices in the field, a change to a market-facing trading algorithm — the board is doing real work, the deliberation is the point, and continuous deployment of that class is not a goal worth pursuing.