Governance, assurance and change control
Governance, assurance and change control
This domain tests decision rights, stage gates, assurance and controlled change.
Core rules
- Governance sets decision rights, accountability, policies and stage gates; the sponsor owns the business case.
- Assurance provides independent evidence that governance and delivery are effective; it is not the same as quality control.
- Change control: log the request, assess impact on scope, schedule, cost, risk and quality, decide via the change board, update baselines and communicate.
- Configuration management controls versions of documents and products.
- Escalate breaches of tolerance; do not silently absorb change.
Worked example
A change request adds single sign-on. Impact: 10 extra development days, 15k cost, low risk and no benefit change. The change board approves because the sponsor has contingency. The schedule and cost baselines are updated, and the configuration librarian records the new design version. Reasoning: the decision uses impact data and authority; approval without baseline update would create a false record.
Traps
- Treating assurance as a tick-box audit.
- Bypassing the change board because 'it is small'.
- Approving change without updating baselines or contracts.
- Confusing governance with day-to-day management.
- No separation between decision-makers and assurance reviewers.