Programme and project assurance: when needed but not wanted, gone when wanted but not needed

"What d'you do for work now Dad?" came the young passenger's opening gambit during one taxi run. Ahhh ... a glance in the rear view mirror at a lifetime of achievements and experiences for a quick answer - no such luck.

Heading towards three decades of successful endeavour in universities has led me to the new door of programme and project assurance - at the moment in relation to digital and physical estate transformation programmes. And, at the present time, with scrutiny on the Post Office and its Horizon system, a timely pause for thought about this aspect of programme and project governance that appears to have a relatively quiet profile - unless, say, you work in central Government and engage with the Infrastructure & Projects Authority.

Here's a long-ish reverie - if you're interested! - about what, to this newbie, seems to lie behind this door of programme and project assurance. See what resonates with readers and what thoughts back might emerge in time.

Temporary but significant

Projects, programmes and portfolios ('P3', or 'projects') are, in theory, temporary structures with a defined beginning and end; and, through the careful planned use of resources, they deliver mandates for change. Being temporary organisations within a business context does not make them less important than standing departments or services. In some quarters unfamiliar with project delivery, 'projects' might be mentioned slightly casually as if to under-appreciate the nature of what needs to be done. Rather, being temporary organisations underlines the skills, passion and professionalism needed for them to create the desired impact and long-term legacy, often using multi-million pound budgets.

Successful delivery of P3 should have a major impact on economies, organisations and people's lives. P3s are frequently complex due a multiplicity of dimensions: inter-related projects, long-term horizons, scale, dispersed project teams, diverse stakeholder expectations, extended supply chains, and more. P3s deserve the focus and desire to set them up to succeed, monitor their progress, recognise inherent risk, and make timely decisions.

Safeguarding investment in change mandates

P3 assurance is one of the ways to safeguard this investment, acting as an independent early-warning mechanism; helping to identify and understand inherent challenges to success; providing information for decision-making; and providing a degree of confidence to governance bodies. There's another of my LinkedIn posts about the joys of realising benefits which explores the mutual interests of P3 and strategic planning where experience of the latter is handy.

P3 assurance is the discipline of independently providing confidence to stakeholders that P3s will achieve their scope, time, cost and quality objectives within the resources available to the project, and realise their benefits. The focus is on key risks and controls, and should align to the wider business risk management framework. P3 assurance should:

• give stakeholders confidence that resources are not being wasted or potential value lost as a result of shortcomings in the delivery of P3s whilst achieving agreed objectives.
• entail independent analysis and peer challenges to P3 team(s), approached through evaluation of documentation and engagement with key stakeholders - focused on increasing the likelihood of successful P3 outcomes.
• involve planned and coordinated proportionate reviews on specific elements or any P3 by the P3 teams themselves and also by internal or external assurance with regard to cost and time impacts.
• examine the ways in which key P3 risks and issues are identified and managed, and actions taken to ensure realisation of benefit.
• involves identification of actions to address findings and subsequent follow-up or consequential assurance, to ensure such actions have been effective as part of continuous improvement.

Assurance framework

Projects and programmes are delivered through a variety of methods as appropriate to their objectives and contexts, e.g.: waterfall, PRINCE2, RMI PMBOK, scrumban, agile, scrum, kanban ... and also RIBA Plan of Work for construction. Assurance activities should evolve and adapt to reflect this variety of methods and reference project lifecycles, whilst retaining a clear line of sight on key areas for project success.

In developing a start-point P3 assurance framework to enable this form of adaptive assurance, much use has been made of a range of resources including guidance and materials provided by Government Infrastructure & Projects Authority, HM Treasury, Association of Project Management (APM), PRINCE2, RIBA Plan of Work, and Managing Successful Programmes (MSP). These resources themselves provide a basis for assurance that the P3 assurance approach itself is well-founded and aligns to an expected standard of practice - a 'who guards the guards' moment.

Assurance is supposed to be required whenever authority or responsibility is delegated to another individual or team. This delegation is governed using defined structures and the 'three lines' model used in risk management - which is an effective way of identifying and coordinating assurance roles and responsibilities. Whereas all employees have a responsibility to differing extents for risk management, only some have a responsibility for project assurance.

First line roles are P3 Sponsors and P3 managers, owning and managing P3 risks in line with P3 risk appetite and escalating where needed. Second line roles are P3 assurance functions working with the first line in planning and achieving P3 integrated assurance plans. First and second lines report upwards to governing bodies for accountability, risk insight and advice, and P3 performance reporting; and, in return, receiving direction, delegation and risk decisions. Third line involves internal and/or external audit, perhaps giving assurance of the effectiveness of project assurance framework and practices.

Given the three lines of defence, project and programme management should include forms of assurance in their practice, but this may not always happen or be consistently sustained for a wide range of reasons. This could be due for example to low maturity of P3 practice and governance within the sponsoring organisation, or turnover in project manager roles. The task of independent assurance is to build an integrated assurance approach to fulfil the principles of successful project assurance; minimise duplication across P3 assurance activities by different assurance providers; mitigate against assurance 'overload' from P3 hierarchies; and avoid assurance gaps and confusion from differing findings. This is no overnight job.

Types of project assurance

In theory, the objective of project assurance as part of project practice is to provide a risk, status, quality review and assessment mechanism over a project lifecycle - be it stage gated waterfall or agile. Any number of several assessment variations mapped to the project lifecycle can be used, but tailored according to P3 risk profiling, e.g.:

• risk potential assessment at the outset and updated during the lifecycle, which use the key drivers for project success to identify, evaluate and prioritise the potential impact of project risk areas on project success.
• quality checkpoint ('gate') reviews that occur over the life of the project and focused on the critical tasks at the particular time in the project. They may recommend improvements to critical processes and deliverables, focus on project risks, and develop mitigation strategies.
• 'Go-Live' reviews undertaken just before implementation or project completion and which aim to confirm that the people, processes, and systems are ready to adopt the changes to be implemented. These reviews should help identify major risks that may affect project success.
• Post-implementation reviews which evaluate whether the business and system goals have been achieved, and help identify areas for additional work to promote project benefit (e.g. change adoption, operational support, new processes and procedures). Lessons learned and best practices are also gathered for future use.
• Different forms and foci for maturity assessment at the different P3 levels, or perhaps in relation to project management office governance, tools and methods.
• Light or fuller project performance health checks, using a common toolkit for consistency.
• Deep dives into particular areas of risk (e.g. business case development, testing, planning and estimating, knowledge management, etc.) - which may be identified in risk potential assessments and/or as part of assurance planning in consultation with executive and delivery sponsors.

Assurance plans should identify assurance activities throughout the P3 lifecycle. Activities or investigations conducted at planning stages will rely on assurers' experience to foreshadow risk and implications for the future. Those done during implementation rely on uncovering the actual risks faced by P3s in the present. Assurance focused on post-implementation rely on observing compliance to standards, procedures and practices executed in the past. Appropriate specialist knowledge and skills may be required in each scenario. There might be spotlights on:

• project risk - its identification, reporting and mitigation.
• requirements gathering given that quality is a key focus of interest in project assurance.
• quality plans and their implementation.
• benefits realisation and the project's plan for managing this.

Soft skills and ethics

An independent assurance function will not have the scope nor occasion to know all of the details and complexity that P3 teams are handling to deliver P3 success. Being in this professional space located outside of P3 teams and firmly in the business calls on a particular blend of experience in the business, know-how relating to P3, and people skills. It also needs to reckon with the sponsoring organisation's maturity with P3 governance and the extent to which executive and delivery sponsors understand their roles, and feel supported alongside their other remits and responsibilities. (It's here that some reflection comes to mind about the role of robust P3 assurance within the Post Office during its implementation of Horizon.)

In developing a draft P3 assurance framework with definitions, principles of successful assurance, and toolkit of assurance artefacts, it feels appropriate to give attention to the soft skills and to a code of conduct to put boundaries around how the work is carried out with those people who are striving hard to realise benefits for the business through change and project mandates.

Oh! So you're like Nanny McPhee!

Of course, the young passenger didn't hear all of this reverie but from whatever was said, the reaction was to liken assurance to those times when intervention is needed but not wanted, in contrast to being wanted but not needed. A proportionate risk-based approach. Whether that's quite the full story remains to be seen, particularly if the soft skills used make the presence of an independent assurer welcomed and deeply valued by sponsors and P3 teams alike.