When an IT change could affect many users, cause downtime, or introduce business risk, it should not be done casually or without coordination. That is where a Change Management Request (CMR) and a Change Advisory Board (CAB) come in.This process comes from IT Service Management (ITSM), which is a set of industry best practices used to plan, review, communicate, and carry out IT changes in a controlled way. The goal is simple: make important changes more safely, with better communication and fewer surprises.
What is a CMR? #
A Change Management Request (CMR) is a formal request to review and plan an important IT change before it is made.
A CMR helps answer questions like:
- What is changing?
- Why is the change needed?
- What systems or users could be affected?
- What is the risk if something goes wrong?
- When should the change happen?
- What is the rollback plan if the change fails?
- Who needs to be informed or involved?
In simple terms, a CMR is the written plan for a change that matters.
What is a CAB? #
A Change Advisory Board (CAB) is the group that reviews important changes before they are performed.
The CAB is not just a technical meeting. It is a shared review process that brings together the right people to look at:
- Business impact
- Risk
- Timing
- Dependencies
- Communication needs
- Rollback planning
Best-practice sources describe CAB as a forum that helps assess, prioritize, authorize, and schedule important changes, while also giving the change manager the information needed to make a decision.
Where does this come from? #
CMRs and CABs come from ITSM (IT Service Management) best practices. In frameworks such as ITIL (Information Technology Infrastructure Library), change control exists to help organizations assess changes, reduce avoidable disruption, and protect service quality.
Different organizations may use slightly different names or workflows, but the purpose is usually the same: review important changes before they affect production systems and business operations.
Why do we use a CMR and CAB? #
We use this process because important changes should be planned, communicated, and reviewed, not rushed.
The biggest reasons are:
- Reduce risk. Important systems should not be changed without reviewing the possible impact.
- Prevent unnecessary downtime. Proper planning helps avoid outages and surprises.
- Improve communication. Everyone knows what is changing, when it is happening, and what to expect.
- Create shared responsibility. Stakeholders can raise concerns, ask questions, and suggest improvements before work begins.
- Support better outcomes. A planned change is more likely to succeed than an uncoordinated one.
Bottom line: A CMR with CAB review helps make sure everyone is on the same page before a high-impact change starts.
When do we use a CMR with CAB review? #
We typically use a CMR with CAB review when a change has the potential for company-wide impact, downtime, or meaningful business risk.
This often includes changes involving:
- Servers
- Firewalls
- Switches
- Wireless access points
- Line of business (LOB) software that supports daily operations
- Core business applications used by many employees
- Company-wide updates that could affect multiple users or departments
- Critical supporting infrastructure such as battery backups, internet services, or related components that support production systems
It is important to understand that a CMR is not only for brand new hardware or software. It may also be used for:
- Replacing an existing device
- Changing a provider or connection
- Applying a major update
- Making a configuration change
- Performing maintenance that could affect critical operations
Examples of changes that may need CMR and CAB review #
- Replacing a firewall at a main office
- Changing internet providers for a business location
- Updating or migrating a server that hosts shared files or applications
- Changing a switch that supports phones, wireless, or production devices
- Updating line of business software that the company relies on to operate
- Replacing a battery backup that protects critical infrastructure
- Rolling out a company-wide software change with possible user impact
Core requirements of a CMR with CAB review #
At a minimum, a strong CMR and CAB process should include the following:
- A documented change plan. The change should be written out clearly, including scope, timing, impact, communication, and rollback steps.
- Change Manager approval. The change manager should review the plan and make the approval decision.
- The right review panel. The CAB should include the right mix of IT, decision-makers, and people who understand the affected systems or business impact.
- Execution ownership. The implementation side should be coordinated so the approved CMR is carried out properly, on time, and in the approved window.
ServiceNow best-practice guidance emphasizes two fundamentals for an effective CAB: the right people and an effective meeting structure. ServiceNow and Atlassian also describe the change manager as the role that coordinates the process, leads or manages CAB review, and makes or drives approval decisions based on the change plan and stakeholder input.
Who owns the decision? #
The Change Manager is the most critical role in the process. The CAB provides input, questions, recommendations, and risk feedback, but the change manager typically owns the plan, controls the approval decision, and is accountable for the result.
That matters because CAB is not meant to be a vague group discussion. It is meant to support a clear owner who is responsible for moving the change forward properly. ServiceNow specifically describes the change manager as the role that coordinates stakeholders, manages the CAB, makes final decisions to approve or reject proposed changes, and directs implementation of approved changes.
Key roles in the CAB #
The exact people involved depend on the change, but these are common best-practice roles:
- CAB Owner or Manager (Chairperson): Leads the meeting, structures the agenda, and keeps the review focused.
- Change Manager: Manages the overall process, owns the change plan, and is accountable for approval and execution.
- Service Owner: Represents the business interest of the affected service.
- Technical Lead or IT Operations: Reviews technical impact, dependencies, and implementation considerations.
- Security Manager or Security Representative: Reviews security, compliance, and risk concerns.
- Business Representatives or Decision-Makers: Provide operational perspective, timing needs, and business impact insight.
- Project or Implementation Coordinator: Helps ensure the approved change is scheduled, communicated, and executed properly and on time.
Best-practice sources commonly describe CAB membership as a mix of change management, technical experts, and business representatives, assembled according to the systems and services affected by the change.
Planning timeline and approval windows #
One of the most important things for end users and stakeholders to understand is this: CMRs and CAB-reviewed projects are usually not next-day work.
These changes are planned in advance and often have:
- Defined review dates
- Specific approval deadlines
- Scheduled maintenance windows
- Communication deadlines
- Go or no-go checkpoints
If the approve-by deadline is missed, the project may need to be delayed to the next available window. That is not unnecessary red tape. It is part of making sure the change is reviewed properly, staffed correctly, and completed safely.
ServiceNow notes that normal changes typically require formal assessment and authorization and are often scheduled around maintenance windows and blackout windows to reduce disruption.
Important: If required approvals are not received by the stated deadline, the change may be postponed. This protects the business from rushed or poorly reviewed work.
How does a CAB usually operate? #
While every organization may run it a little differently, the process is usually straightforward:
- The change is submitted. A CMR is created with the details of the proposed change.
- The change is reviewed. The right people review the impact, risks, schedule, and communication plan.
- Questions or improvements are discussed. Stakeholders can identify conflicts, concerns, or better approaches.
- A decision is made. The change is approved, adjusted, postponed, or declined.
- The change is communicated and scheduled. Users and stakeholders are informed as needed.
- The change is performed. The work is completed according to the approved plan.
- The results are reviewed. If needed, the team reviews the outcome and captures lessons learned.
Smaller organizations may combine roles #
In smaller organizations, especially those under about 250 staff, not every CAB role will exist as a separate person. It is common for roles to be combined.
For example:
- One person on the business side may act as the service owner, decision-maker, and operational representative.
- One person on the IT side may act as the change manager, technical lead, and implementation coordinator.
That is still workable as long as the change is reviewed thoughtfully, the business impact is represented, and someone clearly owns approval and execution.
Does every change require a CMR and CAB? #
No. Not every small task needs a formal review. Routine, low-risk, well-understood work may follow a simpler process. A CMR with CAB review is generally used when the change is more significant and could affect availability, security, operations, or many users. That is why this process is usually focused on important production changes, not every everyday IT task.
Why this matters to end users #
From an end-user perspective, this process helps protect the systems your company depends on every day. It also improves communication around important changes so teams know what is happening, when it is happening, and what impact to expect.
In other words, CMR and CAB review exist to support:
- More predictable changes
- Fewer avoidable disruptions
- Better communication
- Stronger accountability
- Safer business operations
Simple summary #
- A CMR is the formal request and plan for an important IT change.
- A CAB is the group that reviews that change before it happens.
- The Change Manager is typically the key owner who controls approval and accountability.
- This process comes from ITSM best practices.
- We use it when a change could cause company-wide impact, downtime, or risk.
- These changes are usually planned in advance and may be delayed if approval deadlines are missed.
- The goal is better planning, better communication, shared responsibility, and safer outcomes.
Sources #
