Continuous Programme Assurance
Most programmes drift before they fail.

A Snapshot Ages the Moment You Take It.

A point-in-time diagnostic is the right tool when you need a read before a decision. But programmes move. The governance that was sound in March drifts by June, the risk register goes stale, and the next independent read is another engagement away. For programmes in active delivery, the need is not a snapshot. It is a standing discipline that keeps the read current and keeps the parties delivering it honest.

The structural argument underneath both tiers is set out in a three-minute film on the Project Health Check page: why the only account of a programme that reaches its sponsor is written by the people that account describes, and what the Auditor-General found when the reported position was checked against evidence.

Why a Snapshot Cannot Tell You Which Way a Programme Is Going

Three and a half minutes on why a single reading carries no direction, what a 2012 study of project owners in Australia, Norway and the United Kingdom found about detecting early warning signs, and what continuous assurance actually involves week to week.

The Read Goes Stale Faster Than the Programme Moves

You are probably seeing one of these.

Assurance on a Standing Cadence

The same independence and senior read as a Health Check, held continuously across the delivery lifecycle.

Weekly. Monthly. Quarterly.

Predictable, consistent, and defensible. A rhythm the sponsor can rely on and the delivery parties cannot quietly dismiss.

Sized to Your Programme.

A retainer invoiced quarterly, on a cycle that runs from six months to thirty-six. Two of the three tiers are a fixed price. You can read the number, pick the shape that matches your programme, and know what it costs without a conversation first.

All prices exclude GST. What sets the tier is the scale of what is under assurance. A single workstream and a multi-vendor transformation carry different risk, need a different cadence, and are worth different amounts to have independently watched. Enterprise is quoted rather than fixed because above a certain size the programme sets the number, not the tier.

What a Week Actually Looks Like

Assurance that runs continuously has to be light enough to sustain. If it becomes a second programme, it competes with the one it is meant to protect.

A week starts with the data the programme already produces. Plans, risk and issue registers, change requests, test results, defect counts, financial actuals. We read what is there rather than asking anyone to prepare something for us. Where the numbers disagree with each other, that disagreement is itself a finding.

Mid-week is where the judgement happens. We talk to the people doing the work, not only the people reporting on it. A workstream lead who is confident on Tuesday and hedging on Thursday is telling you something a status report will not. That conversation takes twenty minutes and it is usually the most valuable twenty minutes of the week.

The week closes with a short written read. Not a dashboard. A page that says what changed, what it means, and what decision it creates. If nothing material moved, it says that too, and it says it in three lines. An assurance function that manufactures significance every week trains people to stop reading it.

Who Does the Work

One senior practitioner. That is the whole model and it is the part most often got wrong.

Continuous assurance fails when it is staffed by people who have not run a programme. Reading a risk register is not the same as recognising the specific silence that precedes a slipped milestone. The engagement is deliberately held by one practitioner because the value is in pattern recognition, and pattern recognition does not scale by adding people who lack the pattern.

The practitioner who scopes the engagement is the practitioner who delivers it. There is no handover to a delivery team after the sale. On a standing engagement that matters more than it does on a one-off diagnostic, because the value compounds with familiarity. Someone who has watched your programme for four months sees things in week seventeen that nobody could see in week one.

Why This Is Not a Health Check on Repeat

The obvious question is whether continuous assurance is just four health checks a year. It is not, and the difference is structural rather than commercial.

A health check is a point-in-time diagnostic. It goes deep, it produces a ranked set of findings, and it is designed to be commissioned when confidence has already dropped. Its strength is depth. Its limit is that it describes a programme as it was on the day you looked.

Continuous assurance trades some of that depth for continuity. It sees trajectory. A risk that has been amber for eleven weeks is a different risk from one that turned amber last Tuesday. Only one of those is visible in a snapshot. It also sees the things that never appear in a review because they never reach the threshold. Decisions that keep getting deferred. A vendor forecast that has been revised four times without anyone naming the pattern.

The practical distinction is when they help. A health check answers “is this programme in trouble”. Continuous assurance answers “is this programme still on the path we agreed”, every week, before the answer becomes obvious to everybody.

What You Actually Receive

Four things, and deliberately no more.

A weekly written read, one page, covering what changed and what decision it creates. A monthly consolidated view that puts the four weeks together and names the trend rather than the incident. A quarterly assessment scored on the same five lenses used in the Project Health Check, governance, delivery, risk and issues, stakeholder and benefits, so the two are directly comparable. And direct access to the practitioner between those points. Assurance loses most of its value if you have to wait for the next scheduled output to ask a question.

What you do not receive is a portal to log into, a dashboard to interpret, or a monthly deck that restates the programme’s own reporting back to you. Those are the failure modes of assurance, not the product of it.

Month One Is a Baseline, Not a Ramp-Up.

We run the five-lens assessment used in the Project Health Check across governance, delivery, risk and issues, stakeholder and benefits. That produces a scored opening position, agreed with you and written into the engagement before the standing cadence begins.

Everything after it is measured against that baseline. When the quarterly assessment says governance has moved, it is moving against a number you signed off in week four, not against a recollection of how things felt in March.

Where a Project Health Check has been run in the preceding six months, it becomes the baseline and is not charged again.

Five Lenses. The Same Five, Every Quarter.

The quarterly assessment is scored across five lenses, 20 domains and 120 diagnostic questions. They do not change between quarters, which is what makes a trend line mean something.

Scored by a Practitioner, Not by a Model.

The assessment is scored by the person who has watched your programme. Five lenses, 120 diagnostic questions, 20 domains, and a judgement a human is accountable for.

Tooling has a place. It collects the data, it holds the trend, and it makes a weekly cadence affordable. It does not decide whether your governance is sound.

There is a reason we hold that line. A score a model produced cannot be cross-examined. When a board asks why a lens moved from amber to red, the answer has to come from someone who can be asked a second question.

Six Months to Thirty-Six.

Engagement cycles run from six months through to thirty-six. A shorter cycle suits a programme with a defined window, a stage gate to clear, or a delivery phase that ends on a known date. A longer cycle suits a programme where the read needs to hold across the whole lifecycle.

Length is where the value compounds. Someone who has watched your programme for two years sees things nobody could see in month one, and that pattern recognition is the part of this that cannot be bought quickly. Whichever cycle you choose, three things hold.

The exit is tied to our performance, not to the programme's outcome. We do not own the programme, so we will not pretend to guarantee it. Outputs rescheduled by agreement, with planned absence notified in advance, are not misses.

We Will Tell You When You No Longer Need This.

An assurance engagement that cannot describe its own end is a subscription, not a discipline. So here is what finishing looks like.

Most engagements end with the programme. The system lands, the benefits case moves into the business, and the thing being assured stops existing. What happens to the benefits case after that handover is its own discipline. That is the ordinary case and we plan for it from the start.

The better ending is the other one. Your own governance gets strong enough that the second line is internal. The risks we would have surfaced are already on your register before we raise them. The steering committee is asking the questions we used to ask. When the quarterly assessment stops telling you anything you did not already know, we will say so, and we will say it in the assessment rather than waiting for you to notice.

We have nothing to protect in your outcome. That is the whole basis of the read, and it applies to our own engagement as much as it applies to anyone else's.

If You Sit on the Audit and Risk Committee

The committee's problem with a major programme is structural. You are asked to accept assurance about a programme from the programme, and the papers you receive have been written by the people whose performance they describe.

That is not a claim about honesty. It is what a single reporting line does. It is also the reason a second line exists everywhere else in your organisation, and the reason its absence around a large technology investment is usually the last thing anyone notices.

Continuous Programme Assurance gives the committee a read it did not commission from the party being read. Scored on the same five lenses every quarter, so the movement is comparable. Evidenced, so a position can be defended. And independent, because we hold no stake in the systems being implemented and take no vendor or integrator commissions.

What the committee gets is not a better report. It is a second opinion that was not written by the first.

When This Is the Wrong Engagement

Four situations where we will tell you to buy something else, or nothing.

The Read Is Ours, and It Answers to You.

Continuous Programme Assurance holds no stake in the systems being implemented and takes no vendor or integrator commissions. The read is a peer review, unfiltered because we have nothing to protect in the outcome. The tooling we use to hold the trend is a means. The judgement stays independent of it.