How Much Assurance does a Project Need?

Published 22/02/24 under:

Do We Really Need Assurance And Just How Much Of It Do We Require?

In my view we absolutely do require assurance, but exactly how much depends on the project. I like to use the term appropriate and proportionate, as it depends on the cost, scale, complexity and risk of the project in hand. I know many organisations (and people) like to be explicit about the exact amount of assurance required for a project, but I prefer to take each project on its own merit. I don’t feel that there is any one measure that can determine how much assurance is required. A project may be super expensive purely because it is buying very expensive equipment, but it may be low risk and straightforward. Whereas, another project might be relatively low cost, but carry a lot of risk.

It is possible to design simple tools to provide a guide to the level of assurance required. The Infrastructure and Projects Authority (IPA) use the Risk Potential Assessment (RPA) form, and the Association for Project Managers (APM) has its own complexity assessment criteria (easily adapted to assess an individual project). I have also designed bespoke tools for organisations based on their specific criteria so they can identify what gates are required, and who will need to act as the approving body. But I believe that it comes down to a conversation between the Sponsor, Project Manager, any Project Support Staff and the Portfolio Office. Pragmatism is key to getting it right. Assurance should always add value, and is done on behalf of the Sponsor and sponsoring group. It is not done to the project, but for the project. It is your friend and should be welcomed by all project managers.

Comparing Assurance to Travel

I look at assurance like I do the checks before travelling. If I am going to work, I pretty much just pack my bag and go. Yet every now and then I forget something, typically if I haven’t been in to the office for a couple of weeks. If you are going away for the weekend, you may double check you have packed everything, check fuel, tyre pressure (maybe not) and route. Weirdly though, I almost always forget something, once, I even forgot the dog!

Then there are checks by others. When travelling by train, we expect to have our tickets checked, either by going through a gate, or a guard, or both. This doesn’t take long, and we don’t need to think too much about it. We might give ourselves a bit more time to find the right platform in a large or unfamiliar train station. And if the trains aren’t very regular, or we have a reserved seat, we might get there early “just in case”. But we plan these things in.

My final example is that of a flight. Airports are large complex environments that can’t afford to have delays. They also have a lot of security risks and so there are lots of assurance checks along the way. We have to check in, drop off baggage, go through security, passport control, ticket check and finally our seat number. Not to mention all the flight and maintenance checks. These checks are spread out through the airport. It would be ridiculous to expect to do all of these checks once we get to the gate. Similarly, most projects can’t expect to undergo all its assurance checks at a project gate. They must be spread out and planned in.

When we take a flight, we make allowances for all these checks. We arrive in plenty of time. We may even arrive early enough to relax in the departure lounge and have a bite to eat. It is a part of the journey, and there is nothing worse than starting your holiday full of stress because you arrived at the airport late and had to rush through everything to make the plane. Likewise, running a project hot, without planning in sufficient time for assurance, is a sure-fire way of creating stress in the project team.

Plan, Plan, Plan

It is essential that any and all assurance activity is planned for up front. As well as any quality assurance activity to do with the specific product life cycles the project might go through (e.g. commercial, product development etc), a project must also plan for the project life cycle gates. Like our airport example, the gate is a final control point, where the Sponsor asks the project manager “have we achieved everything we need to?”, “do we have permission to depart?”, “do we have the resources we need?”, “Do we know where we are going?” and “Do we know how we are going to get there?”. These questions can only be answered with sufficient confidence if we have done the checks beforehand.

I am not one for box checking. The only document I see as absolutely necessary to move through a project gate is a business case. I don’t care if it is 1 page or 100 pages (well, I will care if it is a 100 pages), but it must justify the reasons for the project. If it is £1000 of spend, the information will be minimal and require just one informal approval gate. If it is £1bn of spend, I want to have confidence that it is the right thing to do, we will get a return on our investment and we are able to deliver it financially, commercially and actually, and it may need to go through 3 stages of approval.

What some projects fail to realise, is that the activity in a stage leading up to business case approval is all about building the business case. Many project teams do a load of work, and then at the last minute write a business case. But there is no point in producing any documentation unless it is in support of a business case. And the reason why I only require a business case, is because in order to write one, you must have done the work. So, the fact that you are able to articulate the case (and give sufficient confidence) means you have got the right amount of documentation in place.

When planning projects, I find it useful to plan the stages around the time it takes to get approvals rather than the time it takes to produce a product. Many organisations work monthly, quarterly and annual cycles. Missing an approval can easily add a month on to a project, maybe more. Getting time with stakeholders can be extremely challenging, and so often approvals become the long pole in the tent. Failing to plan for this means your project plan is unrealistic and the project will not be able to deliver on time and will always be running late.

Understanding Accountability

As with all activity in a project, it is important to understand who is accountable and who is responsible for assurance. When I worked at the Office for National Statistics, we stole an idea from the Ministry of Justice. We made a different Director accountable for the quality of each of the 5 themes in a business case (Strategic, Economic, Financial, Commercial and Management). In turn, they made individuals responsible for determining the level of effort required to produce a business case from the start of the project. They were also responsible for providing the necessary resources to support business case production so that it could go to the approval board by the required date. This took a change in behaviour, moving from a bouncer mentality (“your names not on the list so you aren’t coming in”) to a concierge (“How may I help you”).

Assurance is achieved by going along the journey with the project. It is done in collaboration. We need to understand not only what the project was doing, but why they are doing it. It is important to tailor the effort specifically to each project, and to make it both appropriate and proportionate to the size, scale, complexity and risk. Assurance is all about providing sufficient confidence to the Sponsor and sponsoring group that we should continue to invest in the project. If you have the utmost confidence it will deliver without any checks, then that is sufficient. If you can’t get a straight answer to a simple question, then maybe you need some more.

If you’d like to have a chat about how to strategically plan assurance for your project, we’d love to hear from you.