Transformation is no longer reserved for the largest organisations. New systems, operating model changes, digital programmes, service redesign, regulatory change, AI adoption and finance or HR transformation are now familiar features of organisational life.
These programmes may vary in size and complexity, but they often carry more risk than is visible at the outset. A system change, operating model review or service redesign can quickly touch budgets, people, suppliers, customers, regulatory expectations and the board’s confidence in the organisation’s ability to deliver change.
Most transformation programmes have reporting. They have programme boards, highlight reports, risk registers, action trackers, steering groups, supplier updates and dashboards. The challenge is not usually a lack of information. The challenge is whether that information gives senior leaders and boards a reliable view of whether the programme remains controlled, aligned and capable of delivering the outcome originally intended.
Programme reporting tells leaders what the programme says is happening. Programme assurance helps them understand whether what is happening is enough.
The comfort and weakness of programme reporting
Good programme reporting is essential. Boards and senior teams need a structured view of progress, risk, cost, decisions and delivery milestones. Without that discipline, programmes quickly become difficult to manage and harder to challenge.
However, reporting can also create a false sense of comfort. A programme may be reporting regularly, updating its plans and maintaining its risk register, while still drifting away from the benefits, business outcomes or operational readiness that justified the investment in the first place.
That is particularly true when reporting becomes too internally focused. Programme teams are often under pressure to demonstrate progress. Suppliers may focus on contractual milestones. Workstream leads may report against their own deliverables. Steering groups may become used to the same format, the same language and the same assumptions.
In that environment, the board may receive a clear update, but not necessarily clear assurance.
As Neil Belton, Head of Technology Risk & Programme Assurance at Littlechild & Haley, explains:
“In my experience, the issue is rarely that transformation programmes are not being reported on. Most programmes have plenty of reporting. The real question is whether that reporting gives the board the right level of confidence. A programme team may be able to explain what has happened, what is due next and what the current status is, but assurance needs to test something deeper. Is the programme still aligned to the objectives that justified the investment? Are cost, scope, risk, benefits and readiness still moving together? Are the difficult issues being escalated early enough? Good programme assurance should help leaders see the whole picture, not just a polished version of the project update.”
This distinction matters. A green status can be useful, but it is not assurance in itself. It is a signal that should invite the next question: green against what, based on whose evidence, and with what level of challenge?
What programme assurance should test
The purpose of programme assurance is not to duplicate programme management or create another layer of bureaucracy. Its value comes from asking different questions, from an independent perspective, at a point when the answers can still influence the outcome.
A programme report may describe activity. Programme assurance should test control, evidence and confidence.
| Programme reporting may say | Programme assurance should ask |
|---|---|
| The programme is on track | Are milestones meaningful, current and linked to agreed outcomes? |
| Risks are being managed | Are the most important risks owned, challenged and actively mitigated? |
| Governance is in place | Is governance active, evidenced and making timely decisions? |
| The budget is under control | Is there a clear line between spend, forecast cost, progress and benefits? |
| Benefits are being tracked | Are benefits measurable, owned and still realistic? |
| Go-live is planned | Is the organisation operationally ready for the change? |
These questions are deliberately practical. They are not designed to slow transformation down. They are designed to make sure the organisation remains in control of the things that matter.
This aligns with wider project management thinking. The Association for Project Management’s Conditions for Project Success research identifies factors including project planning and review, goals and objectives, effective governance, competent project teams and commitment to success as having a strong relationship with traditional measures of project success. The assurance role is to test whether those conditions exist in practice, not simply whether they appear in the programme documentation.
For example, it is not enough for a programme to have a governance structure. Assurance should consider whether that governance is working. Are the right people in the room? Are papers clear and timely? Are decisions being made at the correct level? Are risks being escalated, or merely noted? Is challenge recorded? Are actions followed through?
Similarly, it is not enough to say that benefits have been identified. Assurance should consider whether those benefits are measurable, owned and still realistic. A programme can go live and still fail to deliver its intended value if adoption is weak, operating practices do not change, manual workarounds remain, or the original business case is no longer being actively managed.
The real risk is drift
Transformation programmes do not always fail dramatically. In many cases, the greater risk is gradual drift.
A timeline moves. A dependency becomes more complex. A supplier issue is tolerated for too long. A benefit is softened. A cost pressure is absorbed into a revised forecast. A key decision is deferred. A workstream reports green because its own tasks are progressing, while the wider programme becomes harder to coordinate.
Individually, each issue may look manageable. Together, they may indicate that the programme is moving away from its original purpose.
This is why programme assurance should remain focused on outcomes, not just delivery activity. The central question is not simply, “Will it go live?” It is, “Will it work, will people use it, will the organisation be ready for it, and will it still deliver the value promised?”
That requires assurance over several connected areas: strategic alignment, governance, risk management, financial control, benefits realisation, stakeholder engagement, supplier performance, operational readiness and transition to business-as-usual.
Donna Littlechild, co-founder of Littlechild & Haley, sees this as one of the areas where assurance can add particular value for boards and audit committees:
“For boards and audit committees, programme assurance is valuable because it brings the conversation back to purpose. Large programmes can generate a great deal of noise: workstream updates, supplier reports, risk registers, action trackers, steering group papers and revised plans. All of that has a place, but it can also make it harder to see what really matters. Are we still delivering the outcome we set out to achieve? Are the key risks being managed within appetite? Are decisions being made with complete and timely information? Are benefits still credible? Are people ready for the change? Assurance helps create that clearer line of sight, and it supports better decisions while there is still time to act.”
This is the point at which assurance moves from compliance to confidence. It helps boards understand not only whether the programme is being managed, but whether it is being managed in a way that protects the organisation’s objectives.
Assurance should not be a late-stage review
Programme assurance is most useful when it is built into the lifecycle of change, rather than commissioned only when confidence has already been lost.
That does not mean internal audit or assurance teams become part of delivery. Their value comes from remaining objective, independent and able to challenge assumptions that may have become normalised within the programme.
The Global Internal Audit Standards emphasise the importance of internal audit being positioned independently, overseen by the board, able to plan engagements effectively, conduct engagement work, communicate results and monitor action plans. Those principles are highly relevant to programme assurance, particularly where senior leaders need independent insight into complex, high-value or high-risk change.
Early assurance can help identify whether the programme has been set up properly. Mid-programme assurance can test whether risks, costs, decisions and dependencies are being managed. Pre-implementation assurance can consider whether the organisation is genuinely ready for go-live. Post-implementation assurance can assess whether benefits are being realised and whether the change has embedded into business-as-usual.
Each stage has a different purpose, but the underlying value is the same: to provide timely, evidence-based insight that helps the organisation act before issues become embedded.
What good programme assurance gives the board
Good programme assurance should give boards and senior leaders a clearer view of whether:
- objectives and benefits remain clear, measurable and owned
- governance is active, evidenced and making timely decisions
- programme risks are being escalated and mitigated effectively
- financial reporting is aligned to progress, forecast cost and expected benefits
- dependencies between workstreams, suppliers and operational teams are understood
- stakeholder engagement is sufficient to support adoption
- operational readiness has been properly assessed
- transition into business-as-usual is being planned, resourced and controlled
- action plans from assurance reviews are being implemented
The outcome should not be a longer report for the sake of it. The outcome should be better visibility, better challenge and better decisions.
Programme transformation will always involve uncertainty. The aim of assurance is not to remove that uncertainty, nor to slow down necessary change. It is to help organisations understand whether they are still in control of the right things.
For boards, audit committees and senior teams overseeing significant change, that distinction matters. Programme reporting may show what is happening. Programme assurance helps them understand whether what is happening is enough.
References
Association for Project Management, Conditions for Project Success
The Institute of Internal Auditors, Global Internal Audit Standards
