Internal audit and risk professionals know the frustration of witnessing hundreds of millions of dollars invested in projects, only to see many fall short of their intended business outcomes. According to research from Bent Flyvbjerg, a professor at Said Business School of Oxford University, only 8.5 percent of the 16,000 projects studied hit their targets for both cost and time.
It’s a challenge that can put internal audit teams under immense pressure to provide third-line project assurance.
The truth is, good project assurance today needs to go beyond project controls and governance. Large-scale projects rely on complex systems that are difficult to predict and control, and the focus needs to shift to the health of projects and the organization’s overall exposure. Here, we’ll explore four critical project assurance insights that internal audit can use to have a constructive dialogue with stakeholders about actions needed to improve the likelihood of successful project outcomes.
#1. Setting up Projects for Success Is Critical
Major projects often have four critical phases: Direction, design, delivery, and deployment (irrespective of the project methodology).
Setting up projects for success should happen in the direction and design phases. This involves getting stakeholder agreement and buy-in on the direction, what success looks like, and then properly shaping the basic foundations.
Far too often, we find that organizations rush into delivery without agreeing the overall direction, shaping the design, and making sure the basic foundations for delivery are in place. The consequences are stark—our data shows that for highly complex projects:
- 66 percent will achieve significantly less outcomes than planned.
- 63 percent will have significant reductions in scope.
- 53 percent will spend double their original budget.
According to Flyvbjerg’s research, the average cost overrun for large infrastructure projects is 20 percent, the average delay is 20 months, and around one-third do not deliver the project benefits originally promised.
When it comes to project assurance, internal audit teams should be engaged as early as the direction stage. Even if you’ve been asked to review a project go-live, go back and examine what happened in the direction and design stages. Emphasise the need for early intervention and course correction—it’s your best opportunity to protect the investment by identifying potential problems before significant time and cost damage is done.
Key questions to ask:
- Is there an acknowledged way of setting up projects for success in your organisation?
- Is there understanding and buy-in from key stakeholders to the vision and goals?
- Are stakeholders aligned on priorities and trade-offs?
#2. Early and Frequent Adjustments Are Crucial.
For highly complex projects, shaping the direction and design is never “one-and-done” due to the amount of uncertainty, unknowns, and numerous stakeholders with varying interests. As new changes come to light, they need to be constantly assessed to understand the impact, and decision-makers must be open to adjusting decisions accordingly.
A common issue is that organizations don’t consider deployment activities early enough. The tendency is to design the solution in isolation and not the end-to-end business design, which means that projects have an incomplete set of deliverables. Data shows that on average, projects have 20-30 percent of deliverables missing from their plans, making it impossible to successfully realize the full value.
Programs in the design stage tend to build an almost unstoppable momentum and it can seem unpalatable or cost prohibitive to re-visit previous stages and decisions. In extreme cases, leaders may continue to invest in a failing project or decision simply because a lot has already been invested in it—known as the commitment fallacy. But if adjustments are not made at that early stage, where the gap between success and failure is relatively small, the situation will only worsen.
When it comes to project assurance, internal audit can play a crucial role in regular reviews. By having the insights and confidence to challenge, course-corrections can be made long before projects start to fail. By demonstrating the impact of gaps, internal audit will be able to help the business understand the level of delivery risk they will need to accept, or the project benefits they can gain by fixing design gaps or reshaping the program.
Key questions to ask:
- As a result of an assurance review, how many programmes are typically stopped or sent back to an earlier project phase?
- How often do initiatives in your organisation deliver different outcomes than originally planned?
- How regularly are new projects initiated to deliver deliverables that were missed in the original project?
#3. Trade-Offs Must Be Made Early and By the Right People.
In over 50 percent of complex projects, trade-off decisions are made too late, during the delivery and deployment phases. Outcomes and scope are often reduced in favour of protecting time and cost, sometimes to the extent that the business is unable to accept the change, or it adversely impacts day-to-day operations.
Worse still, these trade-off decisions tend to be unplanned changes made by delivery teams and business owners, rather than conscious decisions made by the board or steering committee.
The consequences of poor decision-making and lack of governance are stark. In one of the largest global ERP implementations involving operations in 37 countries, the delivery team reported that most items were green, and they were happy with the status. But the implementation had a catastrophic impact on the business. Independent project assurance subsequently showed that there was lack of alignment of stakeholders and a focus on delivery complexity rather than management complexity.
Internal auditors can play a vital role in ensuring appropriate decision-making processes are in place and help stakeholders make early trade-off decisions, with a clear understanding of the consequences. Governance processes should focus on outcomes and trade-offs, not just hitting milestones and stage gates.
Key questions to ask:
- Do governance processes in your organization focus on hitting milestones and stage gates or trade-offs and outcomes?
- Are stakeholders engaged in early decisions regarding trade-offs and corresponding consequences?
#4. Most Causes of Project Failure Could Be Identified up to 12 Months Before They Occur.
It’s not uncommon to find that the root cause of project failure was evident at the design lifecycle stage, often 7 to 12 months earlier. Flyvbjerg’s research indicates that extreme cost overruns can occur, like a multi-million-dollar project that ended up costing five times the original estimate.
Complex projects need appropriate independent project assurance, to monitor progress and allow ongoing adjustments and early actions to be taken where necessary.
A useful project assurance insight for internal audit is an approach to score and visualize the health of an initiative across 23 “safety factors,” and benchmark “what good looks like.” You can then fast-forward to the next project stage to show the consequences of not addressing the current issues. Similarly, by reviewing previous phases, organizations can learn valuable lessons by pinpointing when signs of project failure were evident and not acted upon.
As an internal auditor, you have the power to provide proactive risk identification and mitigation, helping stakeholders recognize early warning signs and take corrective action before it’s too late.
Key questions to ask:
- During project set up, are you able to predict failure points and drive early proactive intervention?
- Can you determine if a project has addressed gaps in program design before trying to deliver or deploy?
- Is there a shared definition of success? In our experience, speak to ten different stakeholders about the same project and you’re likely to get ten different versions of what “good” looks like.
By embracing these four critical insights, you can help your organization break the cycle of project failures and unlock the path to successful outcomes. Your role as a trusted advisor and strategic partner has never been more important. 
Martin Masson is Director of Assurance Practice at Proteus, a consulting firm based in the United Kingdom.