Change control people actually follow

Change control has two failure modes, and most organizations manage to hit both. Make it too heavy — forms, boards, a two-week queue — and people route around it; work changes, nothing gets recorded, and your baseline becomes a historical novel. Make it too light and every casual “can we just add…” quietly rewrites the plan until no one knows what you committed to.

Match the ceremony to the stakes

Not every change deserves a committee. A good system lets you dial the rigor: for a small team, one person approving might be plenty — or no formal approval at all, with the PM simply recording and applying the change. For a regulated program, require several distinct sign-offs. The mistake is forcing a single heavyweight process onto every project regardless of size; that’s how you teach people to avoid the process entirely.

Approvals that mean something

If you do require approvals, require the right number from the right roles — and don’t let the person who raised the change approve their own. “Two distinct approvers” is a real control; “whoever clicks first” is theater. And every approval should leave a trail: who, when, and why. That record is worth more at audit time than any amount of up-front paperwork.

The step everyone skips: re-baselining

Here’s where most change control quietly fails. A change gets approved — “+$20k, +30 days” — and then… nothing updates. The project plan still shows the old budget and the old end date. Variance reports now compare reality against a baseline everyone knows is wrong, so people stop trusting them.

Approving a change and updating the plan should be one action, not two. When a change is approved, the budget, the end date and the scope should move by the change’s impact, and a fresh baseline should be captured and linked to that change request. Now your variance means something again, and your audit trail tells a clean story: here’s what we agreed, here’s what changed, here’s who approved it, here’s the new plan.

Right-sized approvals plus automatic re-baselining is the whole game: enough control to be trusted, little enough friction to be used, and a plan that always tells the truth.