Assurance: A Project Manager’s Friend

Reading time 6 minutes

Having provided independent assurance to many organisations, one common trait that I always encounter is the genuine fear and loathing project managers have for the process! In a sense this is understandable given the perceived ramifications of a poor assessment – exposure of poorly applied controls, unfavourable comparison with colleagues, loss of face with senior stakeholders – in short, a complete loss of credibility within the transformation community with no ability to defend themselves! I exaggerate of course, as a well conducted exercise should not place a project manager in any of these positions (more on what HCP considers a well conducted exercise later in this blog), however this perception still stands in the minds of many project managers.

Pretence of Control

A behaviour that I often witness is the pretence of control being presented during the assurance process. This tends to take several forms, but ranges from (i) the genuine belief that a control is effective because it exists, through to (ii) diversion tactics, from the project manager, to quickly move the discussion away from a known area of weakness. The second example reminds me of the time I was providing an update on a critical programme to a CFO of a multi-billion-dollar organisation, when the Head of Treasury interrupted the discussion to provide an update on an ongoing internal audit of the function. ‘They’re wrapping up and it looks like we’ve got away with it’ announced the Head of Treasury. Quite what they had ‘got away with’ wasn’t clear, however it delighted the CFO as it clearly related to a control weakness that they didn’t want uncovering. The anecdote I hope illustrates that the perception of an independent assurance or an internal audit is fairly universal, in that for those that are being assessed it is not viewed as a good thing!

So how on earth can I state that assurance is a project manager’s friend? Given the perceived risks they face in having their project assured, how can they take a more constructive view of the experience?

Who’s the Customer?

To start to answer this question I believe it’s important to firstly consider who the customer of the assessment is, to be clear on their needs from the outset, the stage each project is at, be flexible on the approach taken and prepare accordingly. It’s likely that the assessment will have been requested from a senior governance forum, possibly the Risk & Audit Committee, Internal Audit or the Senior Exec, so clearly, they will be a key customer. Not surprisingly, I’m going to suggest that the project managers are also viewed as a key customer of the exercise – either as individuals or as a group (for example, where there are instances of assuring a portfolio of projects). In my experience weaknesses in project controls often reflect:

  • A weakness in a control across the whole organisation
  • Lack of exposure to how a particular control should be applied
  • Automatic / mechanical application of controls by the project manager

I’ll briefly consider all three to demonstrate how project assurance, if applied correctly, and if viewed positively by the project manager, can further enable their personal development.

Beforehand however, I shall highlight two aspects that in my experience help project managers benefit from the assurance experience.

Empathetic Mindset

Firstly, to expect all project managers to positively embrace assurance is unrealistic. From their perspective, they are likely to be managing a complex programme of work to tight deadlines and attempting to mitigate or resolve multiple concurrent risks and issues. In other words, one of the things that they least want to face is an exercise that’s going to take a few hours, with the expected outcome that any weaknesses will cause tension with their sponsor and potentially create a major distraction as a result of the focus of senior stakeholders being directed towards the project. I recall some advice that I benefited from early in my project management career from a senior Exec, which was as far as possible to ‘deliver the project under the radar’. A poor assurance outcome could certainly prevent that from happening!

As one of Steven Covey’s Seven Habits of Highly Effective People state, ‘seek first to understand, then to be understood’ or in other words to prepare for and conduct the assurance assessment in an empathetic way. Covering this behaviour could lend itself to a blog of its own, so let’s not explore this point any further here.

Preparation and the Project Context

As important as an empathetic approach, having a clear understanding of the project context and conducting sufficient analysis before meeting the project manager, is also crucial in enabling a constructive discussion to take place (and therefore being able to place the project manager at ease during the assessment). In other words, the experience of receiving a good assurance assessment shouldn’t feel mechanical or processed. Effective project-based preparation will have allowed the assessor to identify several leads to pursue in advance, either because the control weakness is a known issue for the organisation or the material reviewed beforehand suggests gaps in control. Finally, the stage a project is at is critical as certain controls influence project success more at different stages of the lifecycle. Moreover, certain weaknesses can become locked-in, the further a project has progressed, making the ability to influence project success through assurance more difficult.

Benefits to the Project Manager

Finally, let’s briefly take each of the categories of control weaknesses that were referenced earlier:

a) Control Weakness Across the Organisation

In completing a review of a portfolio of projects, it will become apparent whether a control weakness is inherent across an organisation’s change portfolio rather than across a small number of projects. For example, I recently assessed an organisation’s Digital portfolio and it was apparent that Benefits Management was either lacking or incorrectly applied across most projects. It transpired (not unusually) that little guidance existed and that a very rudimentary approach was being applied by project managers, to little effect. Hallinan Change Projects addressed the issue by designing and delivering a Benefits Management training programme for all project managers and business analysts, accompanied by new guidance and collateral. How well outcomes were truly understood and whether the right deliverables were under development was then the main area of focus at the next quarterly assessment.

b) Automatic / Mechanical Application of Controls

Poorly applied assurance will struggle to pick up instances of project managers going through the motion of applying controls. Simply put, the existence of a risk log (say) will not necessarily mean that risks are being managed effectively. In fact, having an inexperienced assessor provide the view that controls are effective because they exist results in senior stakeholders receiving an inaccurate view of the health of the portfolio of change and unrealistic expectations that all outcomes will be achieved.

Application of controls and how they are effectively assessed is multifaceted and cannot be addressed at length in this blog. I will however highlight one critical element that must be considered when conducting an assessment, is at the heart of being able to manage and deliver complex change and which therefore will benefit project managers’ ability to effectively apply controls – that of organisation culture. It may seem paradoxical that something as ethereal as organisation culture should have central consideration when conducting an assurance assessment, however without this the exercise is in essence sterile and moreover, the management of the project is likely to be formulaic and lead to disappointment. Nobody would ever expect a masterpiece to be created through painting by numbers, and in a similar vein, delivery of complex change isn’t a case of slavishly following the latest methodology that’s on trend. Over the past twenty years I have seen Prince 2, lean sigma and now agile being heralded as the silver bullet for successful project delivery. However, all of these must have people considerations at the heart of the change (i.e. something that doesn’t lend itself to be addressed through a one-fit-all process), and the process of effective assurance is no different.


Exposing these particular weaknesses, to further develop project managers’ capabilities, can be enabled through well conducted assurance. I used this phrase in the opening paragraph of this blog, and I believe the elements of well conducted assurance that ultimately benefit and develop project managers include:

  • Comprehensive review of materials before the assessment, to identify leads to investigate
  • An awareness of the organisation’s culture from a people and change perspective
  • Focus on the most impactful controls, given the project stage
  • The ability to flex the discussion rather than being a slave to the assurance process
  • Always have an outcome focus

Well conducted assurance assessments, like well executed projects, are complex to deliver effectively in order to benefit project managers, transformation leads, Exec, internal audit and risk & audit committees. If you would like to understand more about HCP’s quantitative approach to assurance or to discuss your assurance needs please call on 07584 221 885 or complete the enquiries form.

Neil Hallinan June 2020