--- title: Why Your Change Advisory Board Is Approving Changes Blind description: Your change advisory board judges risk from CMDB data it can't see. Here's what it should demand before approving, and the low-risk changes that need it most. image: https://www.apexconfiguration.com/hubfs/AI-Generated%20Media/Images/Corporate%20Boardroom%20Meeting%20with%20Manager%20Approving.png --- [![APEX CONFIGURATION GROUP](https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png?width=135&height=93&name=ACG-logo.png "APEX CONFIGURATION GROUP")](https://www.apexconfiguration.com/) [![APEX CONFIGURATION GROUP](https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png?width=135&height=93&name=ACG-logo.png "APEX CONFIGURATION GROUP")](https://www.apexconfiguration.com/) - [Home](https://www.apexconfiguration.com) - ServiceNow - [ServiceNow CMDB](https://www.apexconfiguration.com/servicenow-cmdb) - [CMDB Health Check](https://www.apexconfiguration.com/cmdb-consultation) - [CMDB Design & Implementation](https://www.apexconfiguration.com/cmdb-design-implementation) - [Managed Service](https://www.apexconfiguration.com/managed-cmdb-services) - [Automation & Optimisation](https://www.apexconfiguration.com/cmdb-automation-tools) - Maximising ServiceNow - [CMDB Health Dashboard](https://www.apexconfiguration.com/cmdb-health-dashboard-servicenow) - [CMDB Dependency Mapping](https://www.apexconfiguration.com/cmdb-relationship-table) - [CMDB Configuration Items](https://www.apexconfiguration.com/cmdb-configuration-items) - [CMDB Workspace](https://www.apexconfiguration.com/cmdb-workspace-servicenow) - [CMDB Best Practice](https://www.apexconfiguration.com/cmdb-best-practices) - [ServiceNow Discovery](https://www.apexconfiguration.com/servicenow-discovery-setup) - [Service Mapping](https://www.apexconfiguration.com/servicenow-service-mapping) - About - [How We Help](https://www.apexconfiguration.com/about-apex) - [What is a CMDB?](https://www.apexconfiguration.com/what-is-cmdb) - [Benefits](https://www.apexconfiguration.com/benefits-of-cmdb) - Resources - [Blog](https://www.apexconfiguration.com/blog) - [Contact Us](https://www.apexconfiguration.com/contact-us) [Contact Us](https://www.apexconfiguration.com/contact-us) [Contact Us](https://www.apexconfiguration.com/contact-us) - [Home](https://www.apexconfiguration.com) - ServiceNow - [ServiceNow CMDB](https://www.apexconfiguration.com/servicenow-cmdb) - [CMDB Health Check](https://www.apexconfiguration.com/cmdb-consultation) - [CMDB Design & Implementation](https://www.apexconfiguration.com/cmdb-design-implementation) - [Managed Service](https://www.apexconfiguration.com/managed-cmdb-services) - [Automation & Optimisation](https://www.apexconfiguration.com/cmdb-automation-tools) - Maximising ServiceNow - [CMDB Health Dashboard](https://www.apexconfiguration.com/cmdb-health-dashboard-servicenow) - [CMDB Dependency Mapping](https://www.apexconfiguration.com/cmdb-relationship-table) - [CMDB Configuration Items](https://www.apexconfiguration.com/cmdb-configuration-items) - [CMDB Workspace](https://www.apexconfiguration.com/cmdb-workspace-servicenow) - [CMDB Best Practice](https://www.apexconfiguration.com/cmdb-best-practices) - [ServiceNow Discovery](https://www.apexconfiguration.com/servicenow-discovery-setup) - [Service Mapping](https://www.apexconfiguration.com/servicenow-service-mapping) - About - [How We Help](https://www.apexconfiguration.com/about-apex) - [What is a CMDB?](https://www.apexconfiguration.com/what-is-cmdb) - [Benefits](https://www.apexconfiguration.com/benefits-of-cmdb) - Resources - [Blog](https://www.apexconfiguration.com/blog) - [Contact Us](https://www.apexconfiguration.com/contact-us) [Contact Us](https://www.apexconfiguration.com/contact-us) [tel:+442080588135](tel:+442080588135)[mailto:contact@apexconfiguration.com](mailto:contact@apexconfiguration.com) [CMDB](https://www.apexconfiguration.com/blog/tag/cmdb)[ServiceNow](https://www.apexconfiguration.com/blog/tag/servicenow) [IT Governance](https://www.apexconfiguration.com/blog/tag/it-governance)[Change Management](https://www.apexconfiguration.com/blog/tag/change-management) # Why Your Change Advisory Board Is Approving Changes Blind [![Krzysztof Chrzanowski](https://www.apexconfiguration.com/hs-fs/hubfs/krzysztof-chrzanowski.webp?width=40&height=40&name=krzysztof-chrzanowski.webp)](https://www.apexconfiguration.com/blog/author/krzysztof-chrzanowski) by [Krzysztof Chrzanowski](https://www.apexconfiguration.com/blog/author/krzysztof-chrzanowski) 5 min read Sep 28, 2026, 9:00:00 AM Most change advisory boards approve changes on configuration data they never see. The risk rating, the impacted services and the environment on a change all come from the configuration management database (CMDB). If a development server is recorded against production infrastructure, or a critical service has no relationships, the board is shown a low-risk change with a short impact list, and approves it. Nobody on the call is being careless. They're reading a summary built from data nobody checked. This article explains where a board's view of risk actually comes from, how a change classified as low risk can take production down, and what a board should ask for before it approves. For the building blocks behind this, our overview of [how configuration items and relationships fit together](https://www.apexconfiguration.com/what-is-cmdb) is a useful starting point. ## Where the change advisory board's view of risk comes from A change record looks like a form someone filled in. Much of what matters on it is inherited. | What the board sees | Where it actually comes from | | --- | --- | | Affected configuration items (CIs) | Chosen by the requester from the CMDB, often by name | | Impacted services | Calculated from the relationships of those CIs | | Environment | An attribute on the CI or the application service it belongs to | | Business criticality | An attribute on the service, set by whoever last maintained it | | Risk rating | A calculation or questionnaire that uses all of the above | If any input is wrong, the output looks exactly as authoritative as if it were right. That's the problem. A board can challenge a requester. It can't easily challenge a number the platform produced. ## The low-risk change that took production down We saw this on an estate of around seven million CIs at an IT services organisation. Business application environments were believed to be correctly documented, with the infrastructure underneath each environment recorded against it. For one application, it wasn't. The development environment had been mapped to infrastructure that also hosted production. A low-priority change was raised against the development environment. On the data available, it was low risk, and it was treated that way. When the infrastructure was shut down for the change, the production environment went down with it. It wasn't the first time. The organisation's own customer had seen outages like it before, and this time invoked a clause in its contract and left. The cost wasn't an hour of downtime. It was a customer. We fixed the underlying data by first establishing which hardware actually provided the service, then using custom pattern extensions we wrote, followed by top-down, pattern-based scanning. The environments were then mapped from how the application really ran, not from how it had once been set up. ## Why low-risk changes carry the hidden risk High-risk changes get attention. They're discussed, challenged and scheduled carefully. The changes that cause surprising outages are usually the ones nobody discussed. Low-risk and standard changes often bypass the board entirely, or pass through it in seconds. Their low rating comes from the same CMDB data the board would otherwise question. So a wrong environment or a missing relationship doesn't just slip past review. It's the reason the change never reached review in the first place. That makes the data behind low-risk ratings the most important data the board never looks at. ## What the board should ask for before it approves These are the controls we put in place so a board is approving on evidence rather than on a summary. None of them needs new tooling. 1. **Show the evidence behind the impact list.** For each affected CI, the change pack should show its upstream services, its environment, its owner, and when it was last seen by Discovery. A CI last discovered a year ago is a warning, not a fact. 2. **Treat an empty impact list as unanswered.** A change against infrastructure that shows no impacted services goes back to the requester to confirm, rather than forward as low risk. See our article on [why impact analysis is only as good as your CMDB](https://www.apexconfiguration.com/blog/change-impact-analysis-cmdb) for the mechanics. 3. **Check environment against infrastructure.** Before approving a change to a non-production environment, confirm that the infrastructure involved carries no production services. Report shared infrastructure between environments monthly, and treat each instance as a finding. 4. **Sample the low-risk changes.** Each week, the board reviews a small sample of changes approved without discussion. It checks whether the affected CIs and their relationships were right. The sample finds data problems before an outage does. 5. **Escalate repeat failures.** When a change causes an incident on a service that has had a change-related incident before, the service's configuration data goes to its owner for verification before the next change is approved. 6. **Give the configuration manager a seat.** Put the configuration manager on the board, accountable in the RACI for the quality of the data the board relies on. For how relationships are structured and viewed, see our page on [dependency views and CMDB relationships](https://www.apexconfiguration.com/cmdb-relationship-table). ## Measuring whether the board can see Track these as key performance indicators (KPIs), and review them at the board itself: - Changes that caused incidents, split by the risk rating they were given - Low-risk changes whose sampled data turned out to be wrong - Infrastructure CIs shared between production and non-production environments - Affected CIs on approved changes not seen by Discovery in the last cycle If most change-related incidents come from low-risk changes, the ratings aren't measuring risk. They're measuring how complete the data is. ## How Apex helps Our two-week CMDB health baseline scores which of your CIs are trustworthy and which are guesses, including the environment, criticality and relationship data your change risk ratings depend on. The output is a report written for your change advisory board, so the board can see which of its approvals rest on weak data. Where the weak data comes from missing sources, our discovery and integration coverage review establishes what's missing from your estate view and what it costs you during an incident. It's scoped at an initial consultation. [Book a CMDB diagnostic call](https://www.apexconfiguration.com/cmdb-diagnostic-call) or [arrange a meeting with one of our consultants](https://www.apexconfiguration.com/book-a-meeting). ## Frequently asked questions ### How does the CMDB affect change risk ratings? Risk ratings use the affected CIs, their relationships, their environment and the criticality of the services above them. If any of that data is wrong, the rating is wrong, and it looks just as authoritative. ### Why do low-risk changes cause major incidents? Because their low rating often comes from incomplete configuration data, and it means they get the least scrutiny. A missing relationship or a wrong environment makes a dangerous change look routine. ### Should the configuration manager attend the change advisory board? Yes. The board relies on configuration data for every decision, so the person accountable for that data should be there to answer for it and to take away the defects the board finds. ### What should a change pack show about each affected CI? Its upstream services, environment, owner, and when Discovery last saw it. That gives the board the evidence behind the impact list, not just the list. - Recent - Topics - Archive Recent Topics - [ServiceNow (24)](https://www.apexconfiguration.com/blog/tag/servicenow) - [CMDB (21)](https://www.apexconfiguration.com/blog/tag/cmdb) - [CMDB Data Quality (10)](https://www.apexconfiguration.com/blog/tag/cmdb-data-quality) - [Agentic AI (3)](https://www.apexconfiguration.com/blog/tag/agentic-ai) - [CI Ownership (3)](https://www.apexconfiguration.com/blog/tag/ci-ownership) - [Change Management (3)](https://www.apexconfiguration.com/blog/tag/change-management) - [Compliance & Audit (3)](https://www.apexconfiguration.com/blog/tag/compliance-audit) - [Incident Management (3)](https://www.apexconfiguration.com/blog/tag/incident-management) - [Service Mapping (3)](https://www.apexconfiguration.com/blog/tag/service-mapping) - [Vulnerability Management (3)](https://www.apexconfiguration.com/blog/tag/vulnerability-management) - [Cyber Security (2)](https://www.apexconfiguration.com/blog/tag/cyber-security) - [Data Model Design (2)](https://www.apexconfiguration.com/blog/tag/data-model-design) - [Duplicate CIs (2)](https://www.apexconfiguration.com/blog/tag/duplicate-cis) - [Enterprise Risk Management (2)](https://www.apexconfiguration.com/blog/tag/enterprise-risk-management) - [IT Cost Optimisation (2)](https://www.apexconfiguration.com/blog/tag/it-cost-optimisation) - [ServiceNow Discovery (2)](https://www.apexconfiguration.com/blog/tag/servicenow-discovery) - [CI Reconciliation (1)](https://www.apexconfiguration.com/blog/tag/ci-reconciliation) - [CMDB Remediation (1)](https://www.apexconfiguration.com/blog/tag/cmdb-remediation) - [Case Studies (1)](https://www.apexconfiguration.com/blog/tag/case-studies) - [Configuration Management (1)](https://www.apexconfiguration.com/blog/tag/configuration-management) - [Dependency Views (1)](https://www.apexconfiguration.com/blog/tag/dependency-views) - [IRE (1)](https://www.apexconfiguration.com/blog/tag/ire) - [IT Asset Management (1)](https://www.apexconfiguration.com/blog/tag/it-asset-management) - [IT Governance (1)](https://www.apexconfiguration.com/blog/tag/it-governance) - [Operational Efficiency (1)](https://www.apexconfiguration.com/blog/tag/operational-efficiency) - [Problem Management (1)](https://www.apexconfiguration.com/blog/tag/problem-management) - [Service Graph Connectors (1)](https://www.apexconfiguration.com/blog/tag/service-graph-connectors) - [ServiceNow Advisory (1)](https://www.apexconfiguration.com/blog/tag/servicenow-advisory) See all Archive - [September 2026 (13)](https://www.apexconfiguration.com/blog/archive/2026/09) - [August 2026 (2)](https://www.apexconfiguration.com/blog/archive/2026/08) - [July 2026 (4)](https://www.apexconfiguration.com/blog/archive/2026/07) - [June 2026 (3)](https://www.apexconfiguration.com/blog/archive/2026/06) - [May 2026 (2)](https://www.apexconfiguration.com/blog/archive/2026/05) ### Subscribe by email Share this [Share on X](https://x.com/intent/post?url=https://www.apexconfiguration.com/blog/change-advisory-board-cmdb-risk&text=Why+Your+Change+Advisory+Board+Is+Approving+Changes+Blind) [Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https://www.apexconfiguration.com/blog/change-advisory-board-cmdb-risk&t=Why+Your+Change+Advisory+Board+Is+Approving+Changes+Blind) [Share on LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https://www.apexconfiguration.com/blog/change-advisory-board-cmdb-risk&t=Why+Your+Change+Advisory+Board+Is+Approving+Changes+Blind) Previous story [← The CMDB Blind Spots That Cause Most Security Breaches](https://www.apexconfiguration.com/blog/cmdb-blind-spots-cause-security-breaches) ## You May Also Like These Related Stories [Change Impact Analysis Is Only As Good As Your CMDB](https://www.apexconfiguration.com/blog/change-impact-analysis-cmdb) ![Manager drawing connected boxes on a glass wall in an office at dusk, with city lights behind](https://www.apexconfiguration.com/hs-fs/hubfs/AI-Generated%20Media/Images/Thoughtful%20Manager%20Tracing%20Connections%20on%20Glass%20Wall.png?width=480&name=Thoughtful%20Manager%20Tracing%20Connections%20on%20Glass%20Wall.png) [Service Mapping](https://www.apexconfiguration.com/blog/tag/service-mapping) ### Change Impact Analysis Is Only As Good As Your CMDB Sep 22, 2026, 9:45:33 AM 5 min read [CI Reclassification in ServiceNow: Managing Class Changes Safely](https://www.apexconfiguration.com/blog/ci-reclassification-in-servicenow-managing-class-changes-safely) ![IT consultant managing a ServiceNow CI class change safely, illustrating controlled reclassification of a network configuration item](https://www.apexconfiguration.com/hs-fs/hubfs/AI-Generated%20Media/Images/Polish%20Woman%20Sorting%20IT%20Hardware%20with%20Frustration-1.png?width=480&name=Polish%20Woman%20Sorting%20IT%20Hardware%20with%20Frustration-1.png) [CMDB](https://www.apexconfiguration.com/blog/tag/cmdb) ### CI Reclassification in ServiceNow: Managing Class Changes Safely Jun 24, 2026, 1:41:52 PM 3 min read [Why Problem Management Can't Find Root Cause Without A CMDB](https://www.apexconfiguration.com/blog/problem-management-root-cause-cmdb) ![Two engineers examining a circuit board from a server under a magnifying lamp at a workbench](https://www.apexconfiguration.com/hs-fs/hubfs/AI-Generated%20Media/Images/Engineers%20Inspecting%20Circuit%20Board%20In%20Workshop.png?width=480&name=Engineers%20Inspecting%20Circuit%20Board%20In%20Workshop.png) [CMDB](https://www.apexconfiguration.com/blog/tag/cmdb) ### Why Problem Management Can't Find Root Cause Without A CMDB Sep 22, 2026, 10:01:54 AM 5 min read ### Get Email Notifications [![APEX CONFIGURATION GROUP](https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png?width=135&height=93&name=ACG-logo.png)](https://www.apexconfiguration.com/) ServiceNow CMDB specialists delivering enterprise-grade implementation, remediation, and managed services. Address: 20 Wenlock Road, London, England, N1 7GU VAT Number: 505 0347 31 Company Number: 15871442 Email: [contact@apexconfiguration.com](mailto:contact@apexconfiguration.com) [Follow Apex Configuration Group on LinkedIn](https://www.linkedin.com/company/apex-configuration-group) Services - [CMDB Health Check](https://www.apexconfiguration.com/cmdb-consultation) - [Design & Implementation](https://www.apexconfiguration.com/cmdb-design-implementation) - [Managed Service](https://www.apexconfiguration.com/managed-cmdb-services) - [Automation & Optimisation](https://www.apexconfiguration.com/cmdb-automation-tools) - [Health Dashboard & Reporting](https://www.apexconfiguration.com/cmdb-health-dashboard-servicenow) Company - [What is a CMDB?](https://www.apexconfiguration.com/what-is-cmdb) - [Benefits](https://www.apexconfiguration.com/benefits-of-cmdb) - [About](https://www.apexconfiguration.com/about-apex) - [Blog](https://www.apexconfiguration.com/blog) Resources - [Contact Us](https://www.apexconfiguration.com/contact-us) - [CMDB Diagnostic Call](https://www.apexconfiguration.com/cmdb-diagnostic-call) - [Book A Meeting](https://www.apexconfiguration.com/book-a-meeting) © 2026 Apex Configuration Group. All rights reserved. ServiceNow is a trademark of ServiceNow, Inc. We are not affiliated with or endorsed by ServiceNow. - [Terms](https://www.apexconfiguration.com/terms) - [Cookies](https://www.apexconfiguration.com/cookie-policy) - [Privacy](https://www.apexconfiguration.com/privacy-policy) ```json { "@context" : "https://schema.org", "@id" : "https://www.apexconfiguration.com/#organization", "@type" : "ProfessionalService", "address" : { "@type" : "PostalAddress", "addressCountry" : "GB", "addressLocality" : "London", "addressRegion" : "England", "postalCode" : "N1 7GU", "streetAddress" : "20 Wenlock Road" }, "alternateName" : "Apex Configuration Group", "areaServed" : "GB", "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "GB", "availableLanguage" : "en", "contactType" : "customer service", "telephone" : "+44 20 8058 8135" }, "geo" : { "@type" : "GeoCoordinates", "latitude" : 51.530737, "longitude" : -0.09371 }, "image" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/Configuration-data.webp", "logo" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png", "name" : "Apex Configuration Group Ltd", "sameAs" : [ "https://www.linkedin.com/company/apex-configuration-group" ], "telephone" : "+44 20 8058 8135", "url" : "https://www.apexconfiguration.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.apexconfiguration.com/#website", "@type" : "WebSite", "inLanguage" : "en-GB", "name" : "Apex Configuration Group", "publisher" : { "@id" : "https://www.apexconfiguration.com/#organization" }, "url" : "https://www.apexconfiguration.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "WebPage", "description" : "Your change advisory board judges risk from CMDB data it can't see. Here's what it should demand before approving, and the low-risk changes that need it most.", "inLanguage" : "en-GB", "name" : "Why Your Change Advisory Board Is Approving Changes Blind", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png" }, "name" : "Apex Configuration Group Ltd", "url" : "https://www.apexconfiguration.com/" }, "url" : "https://www.apexconfiguration.com/blog/change-advisory-board-cmdb-risk" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.apexconfiguration.com/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.apexconfiguration.com/blog/change-advisory-board-cmdb-risk", "name" : "Why Your Change Advisory Board Is Approving Changes Blind", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Krzysztof Chrzanowski", "sameAs" : [ "https://www.linkedin.com/in/krzysztof-chrzanowski-cmdb/" ], "url" : "https://www.apexconfiguration.com/blog/author/krzysztof-chrzanowski" }, "dateModified" : "2026-09-28T08:00:00+0000", "datePublished" : "2026-09-28T08:00:00+0000", "headline" : "Why Your Change Advisory Board Is Approving Changes Blind", "image" : [ "https://147949153.fs1.hubspotusercontent-eu1.net/hubfs/147949153/AI-Generated%20Media/Images/Corporate%20Boardroom%20Meeting%20with%20Manager%20Approving.png" ], "mainEntityOfPage" : { "@id" : "https://www.apexconfiguration.com/blog/change-advisory-board-cmdb-risk", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png" }, "name" : "Apex Configuration Group Ltd", "url" : "https://www.apexconfiguration.com/" } } ```