Is there a need for both Project Assurance and Internal Audit? Surely they both do much the same job? Isn’t having both an unnecessary and expensive luxury? That’s an argument I have heard many times in medium and large scale organisations. It especially arises when the role of the assurance function has been poorly defined and it has then been staffed by completely the wrong type of people.
The case for assurance
An internal review of all major change programmes within an international bank revealed that all programmes that had some form of independent assurance process embedded in the programme’s management approach had a status of green i.e. the programmes were on track with no significant risks or issues outstanding that might de-rail the project. All other programmes (i.e. those without any independent assurance process) were either amber, some issues to be addressed, or red, requiring urgent management attention.
From this you could conclude that good project managers recognise the value provided by independent reviews and take up the advice from them. Alternatively, it could be said that less experienced or failing project managers either ignore the need for independent review and advice or don’t recognise they need it. Whichever is true, there is a prima facie case that independent reviews that have their recommendations acted upon reduce the risk of failure.
The right assurance managers
I mentioned above that one of the failure points for assurance functions is not having the right people performing the role. Assurance is not about seeing if the right documents have been produced and they contain the right sections – any half decent PMO can do that. No, it’s about making sure the documents meet their objectives, identify the risks and challenges and address them head on. It’s not about making sure there is a plan but about making sure the plan is comprehensive, realistic and has appropriate contingency. It’s not about is the sponsor happy (although he does need to be), it’s about making sure there is the right level of stakeholder engagement across all aspects and levels of the project.
Such activities can’t be successfully performed unless you have been there, seen it and done it. You need a wardrobe full of the right T-shirts and probably a few grey hairs. Project assurance should be a role every project manager aspires to. It should be the ultimate badge of recognition. You can’t keep all your best project managers in assurance roles so you need to rotate them in and out. I have often found myself and my own assurance managers dropping into projects to fix problems and bring them back on track . “The QA report is great but my PM is not up to implementing it. Can I borrow to QA manager for a couple of months” was an often heard refrain when I ran QA for Barclays de Zoete Wedd.
How to work with Internal Audit
Internal Audit (IA) are primarily concerned with the effectiveness of the internal control functions within an organisation. Projects invariably impact those controls functions which is why they are of so much interest to IA. But IA are less interested, and have little experience in assessing, how a project is run and whether it is doing all the right things.
As project managers, we have to understand our impact on the control environment – it’s one of our key objectives. So when a project manager becomes an assurance manager he knows all about that in spades! So whenever I undertake an assurance role, I sit down with IA and agree the scope of my work. They audit what I do and how I do it, and provided I pass muster, they don’t need to repeat my work. We both save time.
Now at Barclays de Zoete Wedd where I set up and run the Project Assurance function, I set that agreement up across the whole portfolio with the Head of IA. No duplication, a rigorous audit of the QA process which reassured the business of the value of the function, and no duplication of effort or wasting of the business’ time.
Another reason not to rely purely on IA
I’ve mentioned a couple of times the need to have suitably experience project managers performing the Assurance role. I’ve also mentioned that IA don’t have anywhere near the level of project experience needed for the role, In addition, IA is often part staffed by trainee accountants as part of their gathering experience to work higher up in the business. It’s a great training ground from an accounting perpsective, but how can a fresh graduate have the necessary experience to assure a major project?
How to get it right
Let – no, insist – IA audit the project assurance function. Staff the latter with the best project managers you can spare, and keep IA as far away from projects as possible.
The Real Benefits
The real benefits come from an assurance process that is embedded as part of a change culture. Reviews can then assess projects and programmes against a set of agreed standards, collating statistics to be used to drive improvements, sharing best practices and learning from others experiences.
No project or programme is without its problems. It is how those problems are managed that determines the degree or success or failure. A well defined and implemented assurance process helps to improve problem management, promotes learning and sharing of experience, and thereby increases the level of success.