Why every project deserves an independent assurance review

Every project sponsor has sat in a status meeting where the words “on track” didn’t quite match the mood in the room. Nobody was lying. They just hadn’t looked closely enough, recently enough, from far enough outside the project to see what was actually building up.

That’s the gap independent review and assurance is designed to close.

Governments and large capital-intensive companies have known this for decades. The OGC (Office of Government Commerce) Gateway process, used across every Australian state and territory and in New Zealand, puts major infrastructure and ICT projects (typically costing $100 million or more) in front of an independent review team at critical points in their lifecycle. Large multi-billion-dollar projects in the resources sector undergo independent or peer assurance reviews, often with a specific focus for each review. Assurance reviews and functional checks are used across the oil and gas industry to verify asset integrity, operational safety, and regulatory compliance.

The logic doesn’t change: some projects are too important to be allowed to fail.  A team with no stake in the project’s success, no history with its politics, and no attachment to the original plan will see risks the people inside it cannot.

The uncomfortable research backs this up. McKinsey’s analysis of more than 5,400 large IT projects, run with the University of Oxford, found that large IT projects overrun their budgets by an average of 45 percent, run 7 percent over schedule, and deliver 56 percent less value than promised. None of those projects set out to fail. They failed the way most projects fail: gradually, through small unexamined assumptions that compounded until the gap between plan and reality was too wide to close quietly.

You don’t need a multi-million-dollar project for that pattern to apply to you. A funding-critical system rollout, a merger integration, a major restructure, a capital campaign – all carry the same underlying risk: nobody with the authority to raise a concern actually asks the hard questions until it’s too late to act on the answers.

What a good review actually does

A proper program or project review isn’t an audit and it isn’t a performance appraisal. It doesn’t look for someone to blame. It looks at four main things: whether the strategic case still holds, whether governance and decision-making are working the way they’re meant to, whether the real risks are visible and owned, and whether the project is still going to deliver the benefits it was funded for.

The review examines the documentation, interviews the people actually doing the work and the people they answer to, and produces a short, direct report with a rating and a set of recommendations for the project’s sponsor. The value isn’t in the paperwork, it’s in the conversations. Interviewees speak more freely with an outsider than they will in a steering committee meeting, and reviewers ask questions insiders have stopped asking because they’ve become used to the answer.

Not every review needs the full six-gate treatment either. A health check can be run at any stage of a project and tailored to a specific worry, a slipping timeline, a governance concern, a benefits case that no longer adds up, without waiting for a formal gate to come around. A recommendation review, meanwhile, simply checks whether the actions from an earlier review actually happened. Matching the type of review to the actual question you’re trying to answer is half the value.

Timing matters just as much as type. Reviews work best when they happen before a major decision point, not after a problem has already surfaced. Four to six weeks’ notice before a key stage gate, whether that’s a business case approval, a go-to-market decision, or a go-live date, gives you enough runway to act on what the review finds rather than just document it for the post-mortem.

Right-sized for your project

Small and medium organisations often assume assurance reviews are a government-scale exercise: three or four reviewers, five days, a formal delivery confidence rating. They can be. They can also be a single experienced reviewer spending a day and a half with your project documentation and your team, delivering a focused health check on the two or three risks that actually threaten delivery. The rigour scales to the project and the budget. What doesn’t change is the independence, because that’s where the value comes from.

This is also where formal assurance experience earns its keep. The disciplines an experienced reviewer brings, critical thinking, structured interviews, a delivery confidence framework, and a habit of testing claims against evidence rather than optimism, translate directly to any project, in any sector, at any scale. A not-for-profit running a major systems change, a family business managing a generational transition project, or a growing company implementing a new operating model can all use the same rigour a government department applies to a large project, scaled to fit.

The real cost isn’t the review

Organisations that skip review and assurance aren’t saving money. They’re deferring the cost of finding out too late, when the fix is a lot more expensive than the check-up would have been. A short review that catches a governance gap or an unrealistic benefits case is cheap against a project that runs 45 percent over budget and still misses its target. Think of it as buying down risk while it’s still cheap to buy down, rather than paying full price for it later in a crisis.

So before your next major project clears its next milestone, ask yourself who in the room would actually tell you if it wasn’t on track, and whether you’d believe them if they did.