Programme and project assurance: when needed but not wanted, gone when wanted but not needed
Gideon White
Strategic planning | Operations excellence | Programme assurance | Continuous improvement
"What d'you do for work now Dad?" came the young passenger's opening gambit during one taxi run. Ahhh ... a glance in the rear view mirror at a lifetime of achievements and experiences for a quick answer - no such luck.
Heading towards three decades of successful endeavour in universities has led me to the new door of programme and project assurance - at the moment in relation to digital and physical estate transformation programmes. And, at the present time, with scrutiny on the Post Office and its Horizon system, a timely pause for thought about this aspect of programme and project governance that appears to have a relatively quiet profile - unless, say, you work in central Government and engage with the Infrastructure & Projects Authority.
Here's a long-ish reverie - if you're interested! - about what, to this newbie, seems to lie behind this door of programme and project assurance. See what resonates with readers and what thoughts back might emerge in time.
Temporary but significant
Projects, programmes and portfolios ('P3', or 'projects') are, in theory, temporary structures with a defined beginning and end; and, through the careful planned use of resources, they deliver mandates for change. Being temporary organisations within a business context does not make them less important than standing departments or services. In some quarters unfamiliar with project delivery, 'projects' might be mentioned slightly casually as if to under-appreciate the nature of what needs to be done. Rather, being temporary organisations underlines the skills, passion and professionalism needed for them to create the desired impact and long-term legacy, often using multi-million pound budgets.
Successful delivery of P3 should have a major impact on economies, organisations and people's lives. P3s are frequently complex due a multiplicity of dimensions: inter-related projects, long-term horizons, scale, dispersed project teams, diverse stakeholder expectations, extended supply chains, and more. P3s deserve the focus and desire to set them up to succeed, monitor their progress, recognise inherent risk, and make timely decisions.
Safeguarding investment in change mandates
P3 assurance is one of the ways to safeguard this investment, acting as an independent early-warning mechanism; helping to identify and understand inherent challenges to success; providing information for decision-making; and providing a degree of confidence to governance bodies. There's another of my LinkedIn posts about the joys of realising benefits which explores the mutual interests of P3 and strategic planning where experience of the latter is handy.
P3 assurance is the discipline of independently providing confidence to stakeholders that P3s will achieve their scope, time, cost and quality objectives within the resources available to the project, and realise their benefits. The focus is on key risks and controls, and should align to the wider business risk management framework. P3 assurance should:
Assurance framework
Projects and programmes are delivered through a variety of methods as appropriate to their objectives and contexts, e.g.: waterfall, PRINCE2, RMI PMBOK, scrumban, agile, scrum, kanban ... and also RIBA Plan of Work for construction. Assurance activities should evolve and adapt to reflect this variety of methods and reference project lifecycles, whilst retaining a clear line of sight on key areas for project success.
In developing a start-point P3 assurance framework to enable this form of adaptive assurance, much use has been made of a range of resources including guidance and materials provided by Government Infrastructure & Projects Authority, HM Treasury, Association of Project Management (APM), PRINCE2, RIBA Plan of Work, and Managing Successful Programmes (MSP). These resources themselves provide a basis for assurance that the P3 assurance approach itself is well-founded and aligns to an expected standard of practice - a 'who guards the guards' moment.
Assurance is supposed to be required whenever authority or responsibility is delegated to another individual or team. This delegation is governed using defined structures and the 'three lines' model used in risk management - which is an effective way of identifying and coordinating assurance roles and responsibilities. Whereas all employees have a responsibility to differing extents for risk management, only some have a responsibility for project assurance.
领英推荐
First line roles are P3 Sponsors and P3 managers, owning and managing P3 risks in line with P3 risk appetite and escalating where needed. Second line roles are P3 assurance functions working with the first line in planning and achieving P3 integrated assurance plans. First and second lines report upwards to governing bodies for accountability, risk insight and advice, and P3 performance reporting; and, in return, receiving direction, delegation and risk decisions. Third line involves internal and/or external audit, perhaps giving assurance of the effectiveness of project assurance framework and practices.
Given the three lines of defence, project and programme management should include forms of assurance in their practice, but this may not always happen or be consistently sustained for a wide range of reasons. This could be due for example to low maturity of P3 practice and governance within the sponsoring organisation, or turnover in project manager roles. The task of independent assurance is to build an integrated assurance approach to fulfil the principles of successful project assurance; minimise duplication across P3 assurance activities by different assurance providers; mitigate against assurance 'overload' from P3 hierarchies; and avoid assurance gaps and confusion from differing findings. This is no overnight job.
Types of project assurance
In theory, the objective of project assurance as part of project practice is to provide a risk, status, quality review and assessment mechanism over a project lifecycle - be it stage gated waterfall or agile. Any number of several assessment variations mapped to the project lifecycle can be used, but tailored according to P3 risk profiling, e.g.:
Assurance plans should identify assurance activities throughout the P3 lifecycle. Activities or investigations conducted at planning stages will rely on assurers' experience to foreshadow risk and implications for the future. Those done during implementation rely on uncovering the actual risks faced by P3s in the present. Assurance focused on post-implementation rely on observing compliance to standards, procedures and practices executed in the past. Appropriate specialist knowledge and skills may be required in each scenario. There might be spotlights on:
Soft skills and ethics
An independent assurance function will not have the scope nor occasion to know all of the details and complexity that P3 teams are handling to deliver P3 success. Being in this professional space located outside of P3 teams and firmly in the business calls on a particular blend of experience in the business, know-how relating to P3, and people skills. It also needs to reckon with the sponsoring organisation's maturity with P3 governance and the extent to which executive and delivery sponsors understand their roles, and feel supported alongside their other remits and responsibilities. (It's here that some reflection comes to mind about the role of robust P3 assurance within the Post Office during its implementation of Horizon.)
In developing a draft P3 assurance framework with definitions, principles of successful assurance, and toolkit of assurance artefacts, it feels appropriate to give attention to the soft skills and to a code of conduct to put boundaries around how the work is carried out with those people who are striving hard to realise benefits for the business through change and project mandates.
Oh! So you're like Nanny McPhee!
Of course, the young passenger didn't hear all of this reverie but from whatever was said, the reaction was to liken assurance to those times when intervention is needed but not wanted, in contrast to being wanted but not needed. A proportionate risk-based approach. Whether that's quite the full story remains to be seen, particularly if the soft skills used make the presence of an independent assurer welcomed and deeply valued by sponsors and P3 teams alike.