Quorum Failure and Decision Rights Leakage in a Public-Sector Portfolio
A Ministry of Transport digital portfolio contains 26 components worth $95 million. The portfolio governance board is chaired by the CIO and meets quarterly; quorum requires five of nine members. Over the past year, minutes show that only three of nine members attended at least half the meetings. Sixty-two percent of stage-gate decisions were recorded as "approved between meetings" by the chair after email consultation with two members. Three components entered execution without a capacity assessment, and two of those later required re-baselining that the board ratified after the fact. Component managers describe gate criteria as "negotiable," and a well-liked programme director has twice obtained waivers for a mandatory security review. Internal audit has flagged these practices ahead of a treasury review. The CIO wants faster decisions rather than more meetings, and has proposed delegating stage-gate authority directly to the programme directors who run the components.
1. Assess the governance weaknesses and evaluate the CIO's proposal to delegate gate authority to programme directors.
Read the worked answer
There are three distinct failures here and they need different remedies: a decision body that cannot convene (attendance), decision rights leaking to the chair plus two members (authority), and controls being waived by influence (assurance). Treating them as one "slow governance" problem will produce the wrong fix.
On the CIO proposal: it solves speed and destroys accountability. Programme directors are the proponents whose components are being gated; giving them gate authority creates self-approval and removes the independent challenge that a gate exists to provide. It also fails the treasury review test, because it formalises what audit has already criticised.
A defensible alternative:
- Tier components by value, risk, and regulatory exposure. Delegate low-value, low-risk gates to a portfolio office panel under published thresholds with an auditable register; retain high-risk and above-threshold gates at the board.
- Fix quorum structurally: a small core of voting members with named delegates, and advisory attendees who do not count toward quorum. Quarterly plenary plus monthly decision slots.
- Legitimise asynchronous decisions: a defined consent window (for example five business days), a record of who was consulted, and a rule that any member can call a decision to a meeting. The current practice is illegitimate mostly because it is undocumented.
Measure the fix by the percentage of decisions taken in the correct forum with a complete record - not by meeting frequency.
2. Two components were ratified after the fact and the security waiver was granted twice. What should the portfolio manager do about these in-flight components?
Read the worked answer
Separate the remedy from the precedent. Re-litigating past approvals with no new information burns credibility; leaving them unexamined sets the precedent that late approval is acceptable.
Retroactive ratifications: commission a light retrospective assurance review of the two re-baselined components - is the new baseline achievable with current capacity, and are the benefits still valid and owned? Record the outcome as an exception with a named accountable executive. The board should ratify with conditions, not with a clean minute.
The security waiver is a different animal. A schedule or scope waiver is a management decision; a security waiver is a risk acceptance, and it does not belong to the programme director or the chair. Requirements:
- A named risk owner at executive level who formally accepts the residual risk.
- Time-bound validity with compensating controls and a remediation date.
- Visibility to the risk committee or CISO, not only the portfolio board.
- Logging with conditions, so the second waiver is visibly a repeat rather than a fresh judgement.
The portfolio manager's role is to expose and route this, not to accept it. Then fix forward: define which gate criteria are waivable, by whom, and with what expiry.
3. How should decision rights be designed so the board retains control of what matters while decisions get faster?
Read the worked answer
Build a decision rights matrix rather than a delegation policy. For each decision type - funding release, scope change, stage gate, waiver, stop - specify threshold, authority, mandatory consultation, record, and decision service level.
Design principles that matter in practice:
- Tier by materiality using financial, risk, regulatory, and strategic dimensions together. A $200k component touching a regulatory deadline is not low materiality.
- Delegate routine decisions with audit sampling instead of pre-approval; publish the thresholds so component managers stop guessing.
- Assign stop authority explicitly to the portfolio board, never to the sponsor. Stop decisions are where governance most often collapses, because no one wants to be the person who ends a favoured component.
- Set a decision service level (for example five business days) with a defined default on expiry - escalate, not auto-approve.
- Review the delegation quarterly against the decision log; thresholds drift as the portfolio changes.
This gives the CIO the speed argument they want without trading away independence. The matrix should be one page, signed by the accounting officer, and referenced in every gate paper.