The assurance provider who reports to the programme director
A P3O manager leads 5 staff in a government department. The P3O provides assurance reviews, reporting and benefits tracking for 15 projects and 3 programmes. The largest programme, 'Digital Records', accounts for 45% of the portfolio budget. Its programme director is also the P3O sponsor and chairs the assurance board. The P3O manager's annual objectives are set by that programme director. An assurance review last month rated Digital Records 'amber/red'; the programme director asked for the rating to be softened to 'amber' before the board and for the review to be re-run by a 'more constructive' reviewer. A whistleblower has raised concerns. The P3O manager asks for advice.
1. What role and independence problems exist in this arrangement? Explain the consequences for assurance and sponsor accountability.
Read the worked answer
The arrangement creates a self-review and intimidation threat. The programme director owns delivery of Digital Records, chairs the assurance board and sets the P3O manager's objectives. The P3O provides assurance on that same programme. A 'red' finding threatens the director's own budget and reputation, and the P3O manager's performance rating depends on him. Even if no one intends improper influence, findings can be softened, bad news delayed and the board misled. Sponsor accountability is also confused: the P3O sponsor should own the P3O mandate and funding across the portfolio, not just the largest programme. The programme director can be a customer and a delivery owner, but not the assurance sponsor for his own programme. The whistleblower's concern is a symptom of a governance design flaw, not just a behaviour problem.
2. Recommend the reporting lines and governance you would put in place, including the P3O sponsor role.
Read the worked answer
The P3O manager should report functionally to a head of P3O, portfolio director or COO with portfolio-wide accountability, and have a dotted line to the programme for service delivery. Assurance should report to the portfolio assurance function or audit committee, with findings published through a route that the programme director cannot edit. The P3O sponsor should be a senior executive (COO or portfolio director) who sets the mandate, secures funding, appoints the P3O manager and removes blockers - not the delivery owner of the biggest programme. The programme director remains accountable for delivery and for responding to findings. The assurance board should be chaired by someone independent of the programme, or at least include an independent member and minute dissent. Document the RACI: who commissions assurance, who reviews evidence, who signs off findings and who tracks actions.
3. How should the P3O manager respond to the request to soften the rating and to the whistleblower? What competences does this demand?
Read the worked answer
Refuse to change the rating without new evidence. Offer to correct factual errors and to re-run the review with an independent lead and agreed scope, but not with a preferred outcome. Record the request, the evidence and the response in writing; copy the portfolio director or audit committee. Follow the whistleblowing policy, protect the whistleblower from retaliation, and keep their identity confidential. Escalate through the independent route because the sponsor is conflicted. Competences: integrity and courage, political awareness, influence, conflict management, assurance and risk method, and clear communication. The P3O manager also needs the sponsor's backing to survive the escalation; if that is absent, the role is untenable and should be raised with HR or audit.