How would you replace a change advisory board without weakening control?
Show the full answer Hide the answer
What is being tested
Whether you can argue that automation provides stronger control, with evidence rather than assertion.
The argument
A board reviewing dozens of changes across unfamiliar systems approves a description, not a change. It cannot deeply assess most of what it sees, so coverage is shallow.
Worse, it adds latency, which forces batching, which increases batch size — and larger batches are harder to review, harder to diagnose when they fail, and all-or-nothing to reverse. The control makes the outcome worse through the very mechanism it was meant to improve.
Software delivery research consistently finds that external approval processes have little or no positive effect on stability, while frequent small changes with automated verification perform better on both throughput and stability.
What replaces it
Automated gates in the pipeline:
- Automated tests, including contract tests for service interactions.
- Security and dependency scanning.
- Policy checks on infrastructure changes.
- Peer review of the code, which is where human judgement is actually applied usefully — by someone who understands the system.
- Canary deployment with automated comparison and rollback.
Every change is verified identically, without fatigue or availability constraints, and the evidence record is complete: what was tested, what passed, who reviewed, when it deployed.
Why the evidence is better
A pipeline record shows the control operated on every change, with artefacts. A board's minutes show that a meeting occurred and a decision was recorded.
Regulators increasingly accept automated controls where the automation is demonstrable, and making that argument is worth the effort because the delivery benefit is large.
What still goes to humans
Risk-based exceptions: data migrations, changes to security boundaries, cutovers, new integration patterns, changes crossing organisational boundaries, and anything where regulation explicitly requires a named human approval.
Automate the routine; review the exceptional.
How to make the transition
Run both for a period. Measure change failure rate and time to restore under each. Present the data. That is far more persuasive than the argument, and it de-risks the change for whoever must approve removing the board.