Progressive Assurance: Bureaucratic Overhead or a Critical Value Preservation Tool?
Ask any project professional and they can probably recall a time when assurance felt less like helpful guidance and more like another layer of bureaucracy.
Another review. Another health check. Another request for evidence; evidence that has already been provided three times before, to three different teams.
It is therefore easy to see why assurance can end up with a bad name. Terms such as “duplication of effort”, “review fatigue” and even “nugatory work” have become familiar language within project and programme environments. Assurance is sometimes viewed as something that is “done to” a project rather than something that contributes to its success.
Yet this perception creates an interesting contradiction.
Reviews of major projects which have failed, including reports from the UK National Audit Office[1][2], frequently highlight governance weaknesses as part of their lessons learned. Poor decision making. Optimism bias. Inadequate challenge. Weak oversight. Insufficient visibility of emerging risks. However, these are exactly the areas that assurance is intended to identify before they materialise.
That tension matters because assurance is often judged by what it asks of project teams, not by the decisions it helps leaders make. To understand its real value, it is worth separating assurance as a bureaucratic experience from assurance as a governance mechanism.
The real question, therefore, is not whether assurance can add value. Independent challenge and effective oversight are already well-established parts of good governance. The harder question is whether assurance practices have evolved enough to support today’s complex project landscape. Are organisations using assurance to protect the future, or are they still mainly reviewing the past?
[1] https://www.nao.org.uk/insights/lessons-learned-from-major-programmes/
[2] https://www.nao.org.uk/wp-content/uploads/2025/03/lessons-learned-governance-and-decision-making-on-mega-projects.pdf
Assurance Was Never Intended to Be Project Management
Part of the challenge lies in how assurance is perceived.
As projects become larger and more complex, the distinction between delivering the work and assuring confidence in its delivery can become blurred. Assurance is sometimes treated as an extension of project management rather than a complementary discipline serving a different purpose.
Project managers are responsible for execution. Their focus is delivery, schedule, resources, risks and outcomes. Assurance exists for a different reason. It provides sponsors and decision-makers with confidence that governance arrangements remain effective, that controls are working as intended and, perhaps most importantly, that the original rationale for investment still stands.
That distinction matters.
Projects rarely fail because the project team lacks effort or commitment. However, they may fail if decisions are made using incomplete, inaccurate, or overly optimistic information. The purpose of assurance is to challenge that information before leaders commit to further investment, before additional resources are allocated, or before a decision is taken which would take the project along the wrong path.
Seen in that context, assurance is clearly not a delivery activity at all. It is a governance activity. Its purpose is to improve the quality of decision making.
The Legacy of Gate-Based Thinking
Historically, assurance has often been associated with audits, stage gates and periodic reviews.
There was a logic supporting this approach. Projects followed relatively predictable lifecycles and formal checkpoints offered the opportunity for sponsors to confirm readiness before moving into the next phase. Assurance became closely linked with validating delivery status against predetermined criteria.
The difficulty is that modern projects rarely behave in such a linear fashion.
Today’s programmes increasingly involve digital transformation, integrated technologies, regulatory dependencies, Agile delivery models, and more complex stakeholder environments. Important decisions are no longer focused on a small number of major milestones. They take place continually.
When assurance remains centred around periodic reviews, issues can remain hidden for months. By the time they emerge, opportunities have been missed and significant value may already have been lost.
This is where progressive assurance starts to make a difference.
Progressive assurance recognises that confidence cannot be assessed only at fixed points in time. It needs to build throughout the project lifecycle. Assurance becomes less about inspection against predetermined criteria and more about insight. It moves the conversation away from simple pass-or-fail judgements and towards a better understanding of whether the project still has what it needs to succeed.
Progressive assurance becomes particularly important where delivery is undertaken through complex supply chains, alliances, and collaborative delivery models. In these environments, sponsors may delegate responsibility for execution whilst retaining ultimate accountability for outcomes. This distinction is sometimes described as the difference between execution and ensurance. Whereas execution focuses on delivering the work, ensurance focuses on maintaining confidence that delegated activities remain aligned to the sponsor’s objectives, governance requirements, and investment rationale. The concept reinforces that authority for delivery can be delegated, but accountability for achieving the intended outcomes cannot, making continuous visibility and borderless assurance essential throughout the delivery chain.
Where Assurance Really Proves its Worth
One of the most significant mistakes organisations make is viewing assurance primarily through the lens of compliance.
Compliance certainly matters. Regulatory obligations, governance standards, and quality requirements cannot be ignored.
However, reducing assurance to a compliance exercise risks missing its true purpose. The greatest value generated by assurance comes from preserving investment value.
Large programmes commit a substantial proportion of their costs very early in their lifecycle. Decisions that are made during scoping, design and mobilisation often shape outcomes long before significant expenditure actually starts. Once those decisions are embedded, their consequences become increasingly difficult, and expensive, to reverse.
The same principle underpins concepts such as technical debt, quality rework, and late-stage design changes. Problems identified early can often be resolved relatively easily and cheaply. The later the problem is identified, the more complexity and cost increase.
This is where progressive assurance has the potential to create genuine value.
Instead of focusing only on whether a project remains compliant with the process, progressive assurance evaluates whether emerging risks, assumptions, and decisions are gradually undermining the value that justified the investment in the first place.
From this perspective, assurance becomes an exercise in value preservation rather than risk reporting.
This is why independent project assurance is not simply a matter of good practice. Methodologies such as the Orange Book[1], Portfolio, Programme, and Project Governance (P3G)[2], MSP[3], and APM’s Guide to Integrated Assurance Management[4] present it as a fundamental requirement, rather than an optional add-on. In today’s increasingly complex mega project environment, that distinction is important.
The financial argument is just as strong. The NAO[5] has observed that assurance costing £8.3m on a project with annual expenditure of £10.5bn can more than justify itself if it prevents just one serious overrun. Research into Front-End[6] (FEL) reaches a similar conclusion. Drawing on an evaluation of 25,000 projects, it suggests that rigorous early-stage FEL assurance can make projects, on average, 15% more cost effective.
[1] The Orange Book Management of Risk – Principles and Concepts – GOV.UK
[2] Project, Programme and Portfolio Governance (P3G)
[3] Managing Successful Programmes, 5th Edition, Axelos, 2020
[4] Guide to Integrated Assurance Management, APM, 2025
[5] Assurance for high risk projects – NAO report
[6] The Path to Better Site and Sustaining Capital Projects | IPA
Why Assurance Sometimes Fails
If assurance is so valuable, why does it continue to attract criticism?
The uncomfortable answer is that assurance itself is not immune from poor implementation.
Assurance fails when there is insufficient credibility in the recommendations made. Assurance fails when answers are requested from project teams without explaining why the questions have been asked. Assurance fails when the process takes on more importance than the decision it intends to support.
Perhaps most damaging of all is when assurance is commissioned but ignored.
Assurance is only valuable if leadership takes ownership of its findings and acts upon them. As the APM notes[1], assurance provides the evidence base for governance and is only useful where leaders are prepared to change direction in response to its findings.
These failures are not failures of assurance as a concept. They are failures in how assurance is designed, commissioned, and used.
[1] https://www.apm.org.uk/blog/from-evidence-to-action-the-role-of-assurance-in-project-success/
What Needs to Change?
Evolution is the main challenge facing assurance.
With the increasing complexity, interconnectivity and technological advancement of projects, assurance cannot rely on periodic reviews and compliance-driven interventions. In order to deliver on its role in value-preservation, assurance needs to evolve, becoming more strategic, more integrated, and more influential in decision making.
The first step is to strengthen executive ownership. Too often, assurance is viewed as a project support function operating alongside delivery. This risks undermining both its independence and its influence. Assurance should be recognised as a strategic governance capability, sponsored by leadership and able to provide objective challenge on behalf of the decision makers controlling investment in the project, rather than the organisations responsible for delivery.
Equally important is moving assurance earlier in the lifecycle and making it continuous. Significant decisions around project value are often committed long before major expenditure occurs. This means that waiting until formal gates to assess confidence can be too late. Progressive assurance begins at the beginning of the project, testing assumptions, scope, capability, requirements, complexity, and regulatory obligations before they become embedded in delivery.
Finally, organisations need to ensure assurance is used to strengthen investment decisions rather than assessing compliance with delivery processes. Traditional gate reviews often focus on whether predefined activities have been completed. Modern assurance should go further. It should provide an integrated and forward-looking view of confidence, helping leaders determine whether outcomes remain achievable, whether value for money remains realistic, and whether the original investment rationale still holds true.
Collectively, these shifts reposition assurance from a process that reports on performance to a capability that protects value.
The Next Evolution of Assurance
The future of assurance is not more reviews, larger report packs, or additional layers of governance. It is better integration.
Effective progressive assurance cannot be achieved by assurance functions alone. It requires three groups to evolve together. Sponsors must become more effective at defining outcomes, sanctioning investment decisions, and using assurance to inform strategic direction. Project leaders must design and deliver projects in ways that make success measurable, assumptions visible, and progress objectively assessable. Assurance professionals must move beyond retrospective reviews and provide forward-looking insight into whether outcomes remain achievable and value remains protected. None of these capabilities operates effectively in isolation. Progressive assurance is most successful when sponsors, delivery teams, and assurance functions work from a common governance, risk, and compliance framework, creating a coherent view of value, risk, performance, and decision-making throughout the investment lifecycle.
The resulting assurance model brings governance, risk management, controls, delivery insight, organisational capability, and data quality together into a single evidence base for decisions.
This is a shift from the question of whether the project is currently healthy to whether it will remain healthy.
Assurance professionals must therefore move away from being project historians who explain what went wrong after the event. Increasingly, they must become strategic advisers who help organisations make better decisions before value is lost.
Equally, project leaders need to recognise that assurance is not an obstacle to delivery. At its best, it is one of the few independent mechanisms specifically designed to protect the outcomes they are trying to achieve.
Conclusion
The debate over whether assurance is nugatory work or meaningless effort misses the point.
Of course, poorly designed assurance can create administration, duplication, and frustration. Any governance activity that is disconnected from decision making will eventually be viewed as overhead.
However, that is not an argument against assurance. It is an argument for better assurance.
As projects become more complex, more integrated, and more dependent upon rapid decision making, the greater the need for objective challenge. The organisations that will succeed are not those that eliminate assurance in the pursuit of speed. They will be those that evolve assurance into a progressive, forward-looking discipline focused on preserving value and improving decisions throughout the investment lifecycle.
The real measure of assurance should not be how many reviews are completed. It should be seen in the avoidable cost, delay, and value erosion prevented because the right decisions were made at the right time.
How GRC Catalyst can help
GRC Catalyst helps organisations move towards progressive assurance by connecting governance, risk and compliance into a single, practical framework for decision making. It supports sponsors, delivery teams and assurance professionals to see risks, controls, obligations and performance in context, creating earlier insight, stronger challenge and clearer evidence that investment value remains protected throughout the project lifecycle.
Authors
Andy Krolikowski is an experienced independent project, programme, and portfolio management (P3M) consultant with a background in the clean energy, defence, nuclear, and aerospace sectors.
Pamela Stacey is an experienced governance, risk, and compliance (GRC) professional and the founder of GRC Catalyst.
Disclaimer
This article reflects the views and professional judgement of the authors. Where external concepts, frameworks or sources have informed the discussion, they have been referenced as appropriate. The authors are responsible for the substance, interpretation and final editorial review of the article. AI tools were used to support research, drafting refinement and factual checking, but responsibility for the final content rests with the authors.
