PROJECT & DIGITAL DELIVERY
Independent assurance for complex digital programs
Large digital programs fail in predictable ways, yet the warning signs are often visible long before the headlines. How independent assurance gives sponsors and boards an honest view — while there's still time to act.
The track record is sobering
- A McKinsey study with the University of Oxford of more than 5,400 IT projects found that large IT projects on average ran 45% over budget and 7% over time, while delivering 56% less value than predicted.
- Research by Flyvbjerg and Budzier found that IT projects have "fat tails": roughly one in six projects studied had a cost overrun of around 200%, far more than typical averages suggest.
- In Australia, the Queensland Health payroll system — described by the subsequent Commission of Inquiry (2013) as potentially the worst failure of public administration in the country — was projected to cost the state around A$1.2 billion in operating and remediation costs over eight years.
The lessons from these cases are remarkably consistent: unclear scope, governance that heard what it wanted to hear, compressed testing, and warning signs that were raised but not acted on.
Why internal reporting isn't enough
Program teams are not dishonest — they are optimistic, invested and under pressure. Status reporting tends to reflect effort and intent rather than evidence. Sponsors, steering committees and boards often lack the technical depth or time to interrogate it.
Independent assurance addresses this by providing a view that is:
- Independent of the delivery team and its incentives
- Evidence-based, testing artefacts, not just interviewing people
- Forward-looking, assessing the likelihood of success, not only reporting progress
- Actionable, with clear, prioritised recommendations
The IIA Three Lines Model distinguishes management roles from independent assurance. First-line roles deliver services and manage risk; second-line roles provide expertise, monitoring and challenge but remain part of management; internal audit provides independent third-line assurance. Program assurance should therefore be positioned according to its reporting line and independence — often as a second-line challenge function, a third-line internal audit activity or external assurance — rather than as a fixed point "between" the lines.
Australian frameworks already require it
Government has formalised independent assurance for high-risk investments:
- Commonwealth: the Digital Transformation Agency's Assurance Framework for Digital and ICT Investments, part of the Digital and ICT Investment Oversight Framework, requires risk-proportionate, independent assurance for in-scope digital programs.
- Victoria: the Department of Treasury and Finance's Gateway Review Process and the High Value High Risk (HVHR) framework provide independent reviews at key decision points.
- New South Wales: the NSW Digital Assurance Framework applies risk-based assurance to digital investments, including independent reviews at defined gates.
- Commonwealth Gateway Reviews: apply to high-risk proposals selected for the process, generally where specified financial thresholds are met; they do not automatically apply to every major project.
Private-sector boards, regulated entities and infrastructure operators increasingly expect the same discipline.
What effective assurance examines
| Dimension | Key questions |
|---|---|
| Strategic alignment & benefits | Is the case for change still valid? Are benefits measurable and owned? |
| Governance & decision-making | Are decisions made at the right level, on time, with the right information? |
| Scope & requirements | Is scope stable and understood? Are requirements testable? |
| Solution & architecture | Is the design technically sound, secure and integrable? Are key risks retired early? |
| Schedule & cost | Is the plan evidence-based? Is contingency realistic? |
| Vendors & commercial | Are contracts aligned to outcomes? Is vendor performance visible? |
| Data & migration | Is data quality understood? Has migration been rehearsed? |
| Testing & readiness | Is testing sufficient for the risk? Is the business ready to operate the new system? |
| People & change | Do users understand and accept the change? Is capability in place to sustain it? |
Assurance that helps rather than hinders
Poorly designed assurance creates paperwork and defensiveness. Good assurance:
- Is risk-proportionate — deeper on high-consequence programs and at critical gates.
- Uses technical specialists — architecture, cyber, data and engineering issues require people who can read the evidence, not just the RAG status.
- Is continuous where it matters — embedded assurance on large programs finds issues between gates.
- Reports to the right level — findings reach the sponsor and governing body, not just the program director.
- Is constructive — the aim is a successful program, not a critical report.
Frame
Agree the assurance scope, decision points and the questions governance needs answered.
Equip
Combine structured review methods with data analysis of schedules, defects, risks and financials to test claims against evidence.
Validate
Senior specialists in delivery, technology, cyber and engineering assess findings and test them with the program team.
Deliver
Clear delivery-confidence ratings and prioritised recommendations, with follow-up to confirm action.
The best time to hear an uncomfortable truth about a program is before it becomes a public one.
References
- McKinsey & Company (2012), Delivering large-scale IT projects on time, on budget, and on value.
- Flyvbjerg and Budzier (2011), Why Your IT Project May Be Riskier Than You Think, Harvard Business Review.
- Queensland Government, response to the Queensland Health Payroll System Commission of Inquiry.
- Digital Transformation Agency, Assurance Framework for Digital and ICT Investments.
- Australian Department of Finance, Gateway Reviews Process.
- Victorian Department of Treasury and Finance, Gateway Review Process, and Digital NSW, Digital Assurance.
- Institute of Internal Auditors, The IIA's Three Lines Model.