ITIL Management Practices →mediumMultiple Choice

ITIL4F ITIL Management Practices Practice Question

A service provider has a large number of standard, low-risk changes that are requested frequently, such as resetting a password or adding a user to a distribution list. The change manager wants to reduce the administrative burden on the Change Control practice while maintaining an acceptable level of risk. Which approach BEST fits ITIL 4 guidance?

⚠ Common exam trap

The trap here is assuming that all changes must go through the CAB, when ITIL 4 explicitly recognizes pre-authorized standard changes that bypass individual review.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a pre-authorized standard change model with defined triggers, so these changes can be implemented without individual CAB review.

Standard changes are low-risk, repeatable, and pre-authorized, so they can be implemented through a documented procedure without a CAB decision each time. Defining such a model lets the Change Control practice focus attention on normal and emergency changes, which carry more risk. The other approaches either add unnecessary control, misuse Incident Management, or remove control entirely.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use a pre-authorized standard change model with defined triggers, so these changes can be implemented without individual CAB review.
Why this is correct
Standard changes are pre-authorized, low-risk, and well-understood, so they can be implemented using a documented procedure without seeking further authorization each time. This reduces the burden on Change Control while preserving control, because the risk has already been assessed and the model defines exactly when and how the change may proceed.
✗
Delegate approval of these changes to the service desk, allowing agents to authorize any change they believe is low risk.
Why it's wrong here
Delegating blanket approval to the service desk without a defined standard change model removes the structure and pre-assessment that make low-risk changes safe. Individual judgement varies, so risk would not be managed consistently. ITIL 4 favours defined, pre-authorized models rather than open-ended authorization by whoever happens to handle the request.
✗
Route all changes through the full Change Control practice, including the Change Advisory Board (CAB), to ensure consistent risk assessment.
Why it's wrong here
Sending every low-risk, frequently repeated change through the full Change Control practice and the CAB adds unnecessary overhead, delays fulfilment, and consumes time that should be spent on higher-risk changes. ITIL 4 expects the practice to be applied proportionately to risk, so this blanket approach is inefficient and does not reflect the flexibility the guidance encourages.
✗
Reclassify all of these changes as incidents so that they can be handled by the Incident Management practice instead.
Why it's wrong here
Reclassifying changes as incidents misuses the Incident Management practice, whose purpose is to restore normal service operation quickly, not to implement planned alterations to the environment. It would also obscure reporting and bypass the risk assessment that Change Control is meant to provide, creating an uncontrolled and unauditable situation.

Go deeper

ITIL4F ITIL Management Practices Practice Question

Why each option matters

Option-by-option breakdown

Related to this question