Case Study · Change Control Board
How change requests moved through a device-plus-service program.Eight teams. Named signatures. One audit trail.
The Change Control Board (CCB) process used on the Internet appliance program. Defines how change requests are submitted, reviewed, signed, and implemented across Development, Test, Support, Network Ops, Supply Chain, Release, Finance, and Marketing.
- Signatory Teams
- 8
- Change Levels
- Emergency / Normal / Running
- Audit
- Per-request
Key takeaways
Four things to remember.
01
Level the change, then route it
Emergency requires immediate attention and a disposition plan. Normal queues into the regular CCB meeting. Running rolls into the next normal change. One request form covers all three.
02
Signatures have criteria
A Test signature does not mean "we looked at it." It means "the change has been subject to the complete set of tests and the results have been posted to the team." Every team has comparable criteria.
03
Attachments depend on change type
Device changes: specification, drawing, test plan, test results. Client software: release notes, tar file, test plan, test results. Server: release notes. Documentation: revised drawings.
04
Release Management closes the loop
Once all approvals are in, Configuration Management communicates the approved ECO to all parties for implementation, and captures the audit trail.
Overview
This CCB process governed every change to the Internet appliance product family, hardware, client software, server software, documentation, and packaging. It is deliberately heavyweight because the blast radius of a bad change (a shipped device in a consumer living room) is heavy.
Adapt it to the weight of your own change: a SaaS web app does not need eight-team signatures on a copy change. But the shape (defined request form, named reviewers, signature criteria, attachment requirements) translates cleanly to every context we have deployed it in.
01
1. Scope
The Change Control Board will facilitate change requests at "Some IA Maker" for initial release and changes to production released products.
02
2. Submit Change Request
Change requests should be submitted through Development or Program Management. A change request must be written and should include, at minimum, the following criteria:
- Definition of the change: What is the change and why is it needed
- Areas impacted (Device HW, Client SW, Server Team, Network Team, Industrial Design, Manufacturing Process)
- Documentation to be updated (Plan of Record document, Engineering Specification(s), UI spec, user guide)
- Level of Change: Emergency (immediate attention + disposition plan), Normal (process normally), Running (roll into next normal change)
- Dependencies (on other pending changes, on pending decisions, on assumptions)
- Estimated dollar impact to the organization, as applicable (savings or cost)
- Requested date of implementation
03
3. CCB Review
Configuration Management shall solicit approvals from required parties. Normal change requests queue for review at regularly scheduled CCB meetings. Urgent requests are immediately hand-carried and/or emailed to appropriate parties for approval.
Required signatories
- Development (Device only, Client only, Device + Client, Server only, Server + Device/Client)
- Test
- Support
- Network Operations
- Supply Chain
- Program Management / Release Management
- Finance
- Marketing
Signature criteria
- Device Team, signature indicates the change has no impact to device functionality, or the impact has been fully tested with no major customer-impact issues.
- Client Team, signature indicates the change has no impact to the software image, or the impact has been fully tested with no major customer-impact issues.
- Server Team, signature indicates the change has no impact to the server environment, or the impact has been fully tested with no major customer-impact issues.
- Test Team, signature indicates the change has been subject to the complete set of tests and the results have been posted to the team.
- Support Team, signature indicates the change has not introduced customer-impact issues, or any issues introduced have a documented customer response on the support database.
- Network Operations, signature indicates the network infrastructure is ready to support the change.
- Supply Chain, signature indicates supply is available and the Bill of Material has been updated.
- Release Management, signature indicates all CCB signatures captured, all required attachments under document control, and the approved ECO will be communicated to all parties.
- Finance, signature indicates financial impacts are understood and acceptable.
- Marketing, signature indicates the change is required.
Attachment requirements
- Device changes, specification, drawing, test plan, test results
- Client software changes, release notes, tar file, test plan, test results
- Server changes, release notes
- Documentation / packaging changes, revised drawings and documentation
04
4. Approved?
Each member of the Change Control Board, as outlined in section 2 and as required above, must give approval for each change request. The approval should include a commit date representing the readiness date for the approver's functional area. Once all approvals are received by Configuration Management, a notice is sent out to all parties. If one or more approvers do not approve a particular change, the initiator is notified and the change is withdrawn.
05
5. Implement Change
All affected parties are responsible for implementing the change as committed to during the approval cycle. The Configuration Manager is responsible for communicating all changes to the appropriate parties, and for collecting related documentation as necessary.
Take it with you
Download the piece you just read.
The library is free. Tell us who you are so we can send you updated versions. One form; this browser remembers you after that.
In the library
Pair this with.
Process · Change Management
Triage every change. Integrate only the approved ones.
Undisciplined change is the largest single risk to test completion. This process defines the Change Control Board loop (from intake through final approval) so nothing slips into a release untested or unscored.
Read →Case Study · Master Test Plan
The master test plan for a first-generation Internet appliance.
Master test plan for a consumer Internet appliance program. Four phases (integration, system, DVT, PVT), nineteen risk categories, and written entry/exit criteria for each transition. The client name is scrubbed ('Some IA Maker') but the methodology is intact.
Read →Process · The Master Framework
Four phases, applied in order, every project.
The top-level testing process used on every engagement. Four phases contain twelve sub-processes, each of which is documented in its own checklist in this library.
Read →
Keep reading
Related reading
- Primer
Careers in Software Quality: Roles, Skills, and First Steps
What testers, test automation engineers, quality engineers, and test managers actually do, the skills each role uses, and practical first steps for students and career changers, including the ISTQB Foundation certification.
Read → - Primer
Errors, Defects, and Failures: What a Bug Really Is
Everyone says 'bug', but testers use three precise words: error, defect, and failure. Learn the difference, why it matters, and how severity and priority decide which problems get fixed first.
Read → - Primer
How Software Gets Attacked: Common Vulnerabilities in Plain English
The most common ways attackers break into software, explained without jargon: trusting input, broken access control, weak sign-in, misconfiguration, and outdated components. Each one comes with the defense that stops it.
Read → - Primer
How to Report a Bug So It Actually Gets Fixed
Finding a bug is half the job. Learn how to write a bug report a developer can act on: a clear summary, exact steps to reproduce, expected versus actual results, and the habits professional testers use to make every report count.
Read → - Primer
Security Testing Basics: Finding Weaknesses Before Attackers Do
An introduction to security testing for new testers and developers: thinking in threats, designing abuse cases, testing access control, the role of automated scanners and penetration tests, and the rules that keep security testing legal and ethical.
Read → - Primer
Staying Safe Online: Passwords, Sign-In, Phishing, and Updates
The everyday security habits that stop most attacks: strong unique passwords, multi-factor sign-in, spotting phishing, keeping devices updated, and sharing carefully. Written for students, families, and anyone starting out.
Read →
Practices
Where this leads
- QA & testingSoftware testing
Software quality consulting since 1994: we test the releases that matter, coach your team on the method, and measure how its testing matures.
Book a call →