How does ChaRM's Approval Management reduce unauthorized-change risk, and where is it available out of the box?

It uses an approval procedure; out of the box, approval is available only for the request for change.

You can customize multi-step approvals or use the standard (change manager sets RfC to approved); multi-step requires all steps done before 'approved'. Configured in IMG → Change Control Management → Transactions → Approvals → Define Approval Settings.