Should every change be reviewed before it is merged?

Question. Today one of our engineers can merge a change that nobody else has read. This paper asks whether a second engineer should read every change first, and it recommends yes, for a trial of one quarter.

Evidence. In the last quarter our service had 14 incidents. The incident reports say that 9 of them began with a change only its author had seen. In the same quarter the payments team, which already reviews every change, had 2 incidents for a similar number of changes. These are our own numbers, from the incident log, and one quarter is a small sample.

Cost. A review is not free. The payments team measured it: a change waits about four hours for a reviewer, and a review takes about twenty minutes of the reviewer's day. For our team of eight that is roughly one engineer-day a week.

The strongest objection is speed: an urgent fix cannot wait four hours. The answer is a rule for that case. An urgent fix may be merged at once, and it is reviewed the next morning.

Next step. Turn on required review for the service on the first day of next quarter. At the end of the quarter, count the incidents and the hours changes waited, and decide with those two numbers.