Agenda
| Item | Timebox | Owner | Purpose |
|---|---|---|---|
| Previous actions | 5 min | Chair | Close out actions from last meeting |
| Failed or backed-out changes since last CAB | 10 min | Change manager | What went wrong and what changes as a result |
A CAB reviewing forty changes a week is skimming all of them. The agenda structure here assumes standard changes are pre-approved and absent, leaving time to actually interrogate the few that could cause an outage.
Keep standard changes off the agenda. If pre-approved standard changes appear at CAB, the catalogue is not working. Report them as a count and spend the time on changes that carry risk.
Circulate 24 hours ahead. Members who first see a change in the meeting cannot assess it. Distribute the agenda with full change records a day before, and treat late submissions as next week's business.
Review last week's failures first. Start with changes that failed or were backed out. It sets the tone, and the lessons are most useful immediately before approving the next batch.
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
| Item | Timebox | Owner | Purpose |
|---|---|---|---|
| Previous actions | 5 min | Chair | Close out actions from last meeting |
| Failed or backed-out changes since last CAB | 10 min | Change manager | What went wrong and what changes as a result |
More free templates IT teams use alongside this one.
Change control earns its reputation for bureaucracy when every change gets the same paperwork. This form routes by risk: standard changes are pre-approved and need almost nothing, while the genuinely risky ones get the scrutiny that would otherwise be spread thinly across everything.
A change policy earns its place by saying what does not need review. Without a pre-approved standard change catalogue, change control becomes a queue that delays routine work and gives the risky changes no more attention than the trivial ones.
A major incident review is not a longer postmortem. Its job is to examine how the response itself performed (whether detection, escalation, communication, and decision-making worked), which is a different question from what broke.
Failed changes since the last meeting, high and critical risk changes in detail, medium risk by exception, a count of standard changes, retrospective review of emergency changes, and the forward schedule for collisions.
Around an hour if standard changes are properly pre-approved and absent from the agenda. A CAB running longer is usually reviewing routine work that belongs in a standard change catalogue.
Yes, retrospectively and without exception. Reviewing them is how you learn whether they were genuinely emergencies or whether the normal process is too slow, and the latter is the more actionable finding.