Business analysis governance is the set of agreed rules for who decides on requirements and designs, how changes are requested and assessed, how work is prioritized, and who approves what. In the BABOK Guide v3 it is planned in task 3.3, Plan Business Analysis Governance, which produces one output: the governance approach. The CBAP exam tests it inside Business Analysis Planning and Monitoring (14%) and again, indirectly, in Requirements Life Cycle Management (15%).
What business analysis governance means in BABOK 3.3
The governance approach is a plan that names the decision makers, the change control process, the prioritization approach and the approval process for business analysis work. It does not make decisions itself. It decides in advance how decisions will be made, so that the team does not argue about process in the middle of a crisis.
Task 3.3 is the third of five tasks in Business Analysis Planning and Monitoring (BAPM). For the full map of the knowledge area, see the overview of business analysis planning and monitoring. The task has a narrow scope: it governs business analysis work and its outputs (requirements and designs), not the whole project. Project or product governance usually already exists, and the business analyst fits into it.
Why it matters on the CBAP exam
The Certified Business Analysis Professional (CBAP) exam has 120 scenario-based questions in 210 minutes, and BAPM carries 14% of the weight (IIBA CBAP page). Last verified: October 2026.
Governance questions are rarely "name the output" questions. They are usually scenarios: a stakeholder asks for a late change, two sponsors disagree, or a regulator must sign before release. The question then asks what the business analyst should do first. The correct answer almost always points back to the agreed governance approach, or to defining one if it is missing.
The inputs, elements and output of task 3.3
Task 3.3 takes two inputs and turns them into one output. The table below summarizes it, based on the IIBA task cards for BAPM (IIBA task card).
| Part | Content |
|---|---|
| Inputs | Business analysis approach (3.1); stakeholder engagement approach (3.2) |
| Elements | Decision making; change control process; plan prioritization approach; plan for approvals |
| Guidelines and tools | Business analysis performance assessment; business policies; current state description; legal/regulatory information |
| Techniques (among others) | Document analysis, interviews, organizational modelling, process modelling, workshops |
| Stakeholders | Domain subject matter expert, project manager, regulator, sponsor |
| Output | Governance approach |
The inputs explain why the task comes third. The business analysis approach from task 3.1 sets the life cycle (predictive or adaptive) and the level of formality. The stakeholder engagement approach from task 3.2 tells you who has authority and influence. Governance needs both.
How to plan business analysis governance, step by step
Each element answers one practical question. Work through them in order.
1. Decision making: who decides, and how disagreements end
Decide who is the decision maker for each type of decision, who only advises, and what happens when stakeholders cannot agree. A clear escalation path matters more than a perfect matrix. Cynthia Low, writing in BA Times, recommends naming points of contact and an escalation path at the start, with a steering committee that resolves open issues (BA Times, 2008).
2. Change control process: how a change moves from idea to decision
A workable change control process answers a short list of questions:
- How is a change requested, and where is it logged?
- What information must a request include (reason, value, cost, effort, risk, urgency)?
- Who performs the impact analysis?
- Who can approve, reject or defer it, and does that depend on the size of the change?
- How is the decision recorded and communicated?
Size-based authority is common in practice. Laura Brandenburg describes small changes approved by the team or sponsor, larger ones by mid-level managers, and major changes by executives (Bridging the Gap, 2023).
3. Plan prioritization approach: how competing work is ranked
Agree on the criteria (value, risk, regulatory need, dependencies, cost) and on who facilitates and who has the final word. The approach depends on the life cycle: a predictive project may rank a baseline once per phase, while an adaptive team re-ranks a backlog every iteration.
4. Plan for approvals: what gets approved, by whom, and when
Define which deliverables need approval, the approvers, the timing, and the form of approval (signature, recorded decision, acceptance in a review). Regulated industries often need a documented trail; the legal and regulatory information guideline exists for this reason.
How the governance approach links to Requirements Life Cycle Management
The governance approach is planned in BAPM but used mostly in Requirements Life Cycle Management (RLCM). According to the IIBA task cards, it is a guideline or tool for three RLCM tasks, and an input to task 3.4.
| Task | How it uses the governance approach |
|---|---|
| 3.4 Plan Business Analysis Information Management | Input: storage, access and traceability rules must match governance needs (IIBA BAPM cards) |
| 5.3 Prioritize Requirements | Guideline: who ranks and by which criteria (IIBA card) |
| 5.4 Assess Requirements Changes | Guideline: the change control process and who decides (IIBA card) |
| 5.5 Approve Requirements | Guideline: the approvers, timing and approval form (IIBA card) |
A simple way to remember it: task 3.3 writes the rules, and tasks 5.3, 5.4 and 5.5 play by them.
Worked example: a payment feature in an online store
An online retailer adds a "pay in installments" option at checkout. The business analysis approach is a hybrid: high-level scope is agreed up front, details are refined in two-week iterations. A payment partner and the finance department's compliance officer are involved.
The business analyst runs one workshop with the sponsor, product owner, project manager and compliance officer and agrees this governance approach:
| Element | Agreed rule |
|---|---|
| Decision making | Product owner decides on scope inside the iteration; sponsor decides on anything that changes budget or launch date; compliance officer has a veto on legal terms |
| Change control | All change requests go into the team's tracker with reason, value and estimate; the business analyst runs impact analysis within two working days |
| Change authority | Up to 3 days of effort: product owner; above that or any date impact: sponsor |
| Prioritization | Backlog ranked by value and risk each iteration; regulatory items always at the top |
| Approvals | Compliance officer approves customer-facing legal text before release; product owner accepts stories in the review |
Three weeks in, marketing asks to show the installment price on every product page. The analyst logs the request, estimates about eight days of work and a two-week delay. Because the delay affects the launch date, the request goes to the sponsor, not the product owner. The sponsor defers it to the next release. Nobody argued about who should decide, because that was settled in week one.
What practitioners say
Practitioners agree on one point: governance problems show up as sign-off and change problems.
- Stephanie Famuyide, CBAP, notes that sign-off stalls when stakeholders do not understand the specification, and advises: "Get all the relevant stakeholders involved as soon as you start the project." (Modern Analyst, 2014)
- In a 2022 ProjectManagement.com thread on BRD sign-off, Kiron Bondale explains that changes before sign-off are normal, while changes after it go through change control. Another contributor advises agreeing in advance how post-sign-off changes will be handled (ProjectManagement.com, 2022).
- Ananya Pani of Adaptive US lists sign-off delays among the top BA challenges and suggests naming backup approvers and presenting the business case with the sponsor present (IIBA blog, 2023).
- Pushkar Anand points out a step teams skip: first agree that an item really is a change request, then agree its estimate and priority (Modern Analyst).
- Cynthia Low warns that "Clients should not dismiss sign-off as meaningless" (BA Times, 2008).
Common misconceptions about business analysis governance
- "Governance means a change control board." A board is one option. In an adaptive team the product owner may hold change authority. BABOK asks you to plan governance that fits the approach, not to add bureaucracy.
- "The business analyst approves changes." Usually not. The analyst facilitates, analyzes impact and records decisions. Approval sits with the people the governance approach names.
- "Governance is the project manager's job." Project governance may exist, but task 3.3 covers decisions about requirements and designs. The analyst plans how those fit into the existing structure.
- "Approval happens once, at the end." Approvals can be staged, per iteration or per deliverable. The plan for approvals sets the timing.
- "Governance is set once and never changes." The BA performance assessment is a guideline for this task, so lessons from earlier work can change the approach.
Practice Questions
Question 1
During development, a sales director asks the business analyst to add a new discount rule. The rule would delay release by two weeks. What should the business analyst do first?
A. Add the rule to the current iteration because the director is senior B. Follow the change control process defined in the governance approach C. Reject the request because the requirements are already approved D. Ask developers to estimate and start the work in parallel
Answer: B. The governance approach defines how changes are requested, assessed and approved. Seniority (A) does not replace the process, rejection (C) is not the analyst's call, and starting work (D) skips impact analysis and approval.
Question 2
Which output of Business Analysis Planning and Monitoring identifies who has authority to approve requirements?
A. Business analysis approach B. Stakeholder engagement approach C. Governance approach D. Information management approach
Answer: C. The governance approach names decision makers and the approval process. The stakeholder engagement approach (B) describes stakeholders and how to collaborate with them, but approval authority is a governance decision.
Question 3
An adaptive team has no change control board. The sponsor asks the business analyst how requirement changes will be governed. What is the best response?
A. Create a change control board, because BABOK requires one B. Agree that the product owner decides backlog changes within agreed limits, with escalation to the sponsor beyond them C. Freeze requirements for the rest of the project D. Let each developer decide which changes to accept
Answer: B. Governance should match the business analysis approach. In adaptive work, change authority often sits with the product owner, with defined escalation. BABOK does not mandate a board (A), and freezing scope (C) conflicts with the adaptive approach.
For timed practice on another IIBA exam with the same scenario style, try the IIBA CBDA practice exam.
Related techniques and topics
- Traceability of requirements supports impact analysis when a change request arrives.
- Backlog management is how adaptive teams apply the prioritization approach.
- Requirements life cycle management covers tasks 5.3 to 5.5, where the governance approach is used.
FAQ
What is the output of Plan Business Analysis Governance?
The only output is the governance approach. It names decision makers, the change control process, the prioritization approach and the approval process for requirements and designs. Later tasks such as Assess Requirements Changes and Approve Requirements use it as a guideline.
Does the business analyst approve requirement changes?
Usually not. The business analyst facilitates the process, performs or coordinates impact analysis and records the decision. The people named in the governance approach, such as the sponsor or product owner, approve or reject the change.
Is business analysis governance different from project governance?
Yes. Project governance covers the whole initiative, including budget and schedule. Business analysis governance covers decisions about business analysis work and its outputs, and it should fit inside the existing project or organizational governance.
Do agile teams need a governance approach?
Yes, but a lighter one. An adaptive team still needs to know who ranks the backlog, who can change scope, and who accepts work. Often the product owner holds most of this authority, with escalation to a sponsor for larger changes.
Which BABOK tasks use the governance approach?
According to the IIBA task cards, it is an input to 3.4 Plan Business Analysis Information Management and a guideline for 5.3 Prioritize Requirements, 5.4 Assess Requirements Changes and 5.5 Approve Requirements.
Sources
- IIBA: CBAP certification page
- IIBA: Task card, Plan Business Analysis Governance
- IIBA: All task cards, Business Analysis Planning and Monitoring
- IIBA: Task card, Assess Requirements and Designs Changes
- IIBA: Task card, Approve Requirements and Designs
- Business Analyst Mentor: Business Analysis Planning and Monitoring
- Laura Brandenburg, Bridging the Gap: How to Manage Change Requests (2023)
- Stephanie Famuyide, Modern Analyst: 3 Tips for Obtaining Requirements Sign off (2014)
- Pushkar Anand, Modern Analyst: Change Requests for Software Business Analysts
- Cynthia Low, BA Times: Failing to Plan is Planning to Fail (2008)
- ProjectManagement.com: BRD sign-off discussion (2022)
- Ananya Pani, IIBA blog: 10 business analysis challenges and recommended solutions (2023)