Compare
A weekly change board and a spreadsheet record intent, slowly. Aspian Cloud keeps the board for the decisions that need people, and lets policy approve the rest with proof, which is what the DORA research recommends.
Checked on 8 November 2026 against the CAB and spreadsheets sources linked in each row. Products change; follow each source before relying on a row.
- What it is
a CAB and spreadsheets
Manual change governance: a change advisory board meets to approve changes, with approvals and evidence tracked in tickets or spreadsheets.
servicenow.comAspian Cloud
Change control for software: it approves, records and proves every production change, made by people, contractors or AI agents, on any deploy tool.
/product- Effect on delivery
a CAB and spreadsheets
DORA reports that heavyweight external change approval hurts software delivery performance and found no support for formal external review lowering change fail rates; slow approvals drive larger, riskier batches.
dora.devAspian Cloud
People approve only exceptions. Routine changes go out on policy, so batches stay small.
/product/approvals- What DORA recommends instead
a CAB and spreadsheets
DORA recommends peer review in the development platform for segregation of duties, automated testing and monitoring, and repositioning the CAB from gatekeeper to process architect and coordinator.
dora.devAspian Cloud
That model, built in: peer review, automated checks, approval by policy, and people reviewing the exceptions.
/product/how-it-works- Change authority by risk
a CAB and spreadsheets
Secondary ITIL 4 guidance says the 'change authority' replaces a single central CAB. Authority is assigned by risk to delegated teams, peer review or automated pipeline approval, and standard changes are typically automated.
itsm.toolsAspian Cloud
Policy for standard changes, named approvers for normal ones, retrospective approval for emergencies.
/product/approvals- Emergency changes
a CAB and spreadsheets
DORA advises making the normal approval process fast and reliable enough to handle emergency changes too, rather than relying on a separate emergency path.
dora.devAspian Cloud
Ship first, then can’t close until a second person approves afterwards, within the deadline you set.
/product/approvals- What is actually running
a CAB and spreadsheets
A meeting-and-spreadsheet process records intent only. Nothing in it automatically checks what is actually running against what was approved (by construction; no vendor source).
dora.devAspian Cloud
Signed snapshots by artifact fingerprint, a drift item within minutes for anything unapproved, and Unknown never shown as compliant.
/product/runtime-proof
When a CAB and spreadsheets fits better
- Very low change volume, such as a few releases a quarter, where a short meeting costs less than adopting any tool.
- High-impact business trade-off decisions across many teams, which DORA itself says remain a valid CAB role.
- Changes that are not software deploys at all (facilities, contracts, vendor switches), where code-level evidence does not apply.
Running both
- 1Run the free scan to see your real change volume and how much of it is routine.
- 2Turn standard changes into policies, in Evaluate first.
- 3Give the board the exceptions, with the full card for each.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.