Governance, Sponsorship and Decision Rights

Introduction

Project initiation is not complete when a business case is approved or a project manager is appointed. A project also requires an authoritative system for making decisions, resolving conflicts, allocating accountability and assuring that the investment remains aligned with organisational purpose. This system is project governance.

Governance is especially important because projects are temporary, cross-functional and exposed to uncertainty. They often operate across organisational boundaries, involve competing interests and consume resources that could be used elsewhere. Without explicit governance, decisions may be delayed, risks may be concealed, scope may expand informally and accountability may become unclear.

Governance is not synonymous with project management. Project management concerns the planning, coordination and control of work. Governance concerns the direction, oversight and accountability through which the organisation authorises and constrains that work. Effective governance connects strategy with delivery while preserving appropriate managerial autonomy.

Learning Objectives

By the end of this chapter, the reader should be able to:

• distinguish governance, management, sponsorship and assurance;
• design an appropriate governance structure for a project;
• define sponsor, steering group and project manager responsibilities;
• establish decision rights, escalation paths and stage gates;
• apply tolerances and accountability models to project decisions;
• design independent assurance and reporting arrangements;
• evaluate ethical, regulatory and technology-related governance risks.

1. Governance as an Organisational Capability

Governance may be defined as the framework of authority, accountability, decision rights, controls and assurance through which a project is directed and held to account. It answers five fundamental questions:

1. Why should the project exist?
2. Who has authority to decide and commit resources?
3. What outcomes and constraints apply?
4. How will performance and emerging threats be examined?
5. Under what conditions should the project be changed, paused or stopped?

Governance is therefore broader than compliance. Compliance asks whether rules have been followed; governance asks whether the right decisions are being made by the right people, at the right time, on the basis of reliable information.

A useful distinction is:

These levels are connected. A project board should not redefine corporate strategy, and a project manager should not unilaterally approve a material change to the investment case.

Governance versus management

Governance is primarily concerned with direction, control and accountability. Management is concerned with execution, coordination and resource utilisation. The distinction is not absolute: senior managers may perform governance roles, and governance bodies require management information. However, confusing the two creates two opposite dangers. A governing committee may micromanage delivery, while operational managers may make decisions beyond their authority.

Governance should set boundaries and assess exceptions; management should operate within those boundaries. A project manager may choose a sequencing method within approved scope and tolerances. A sponsor may approve a change that exceeds the project manager’s delegated authority. A steering group may recommend termination where the project no longer supports the strategic case.

2. The Principal Governance Actors

The project owner or accountable executive

The accountable executive owns the investment decision and remains answerable for the project’s strategic legitimacy. This person may be called the project owner, senior responsible owner or executive sponsor. Responsibilities commonly include:

• confirming the business need and desired outcomes;
• ensuring that a credible sponsor and project manager are appointed;
• securing organisational commitment and resources;
• approving the charter and major business-case assumptions;
• ensuring that benefits ownership continues beyond project closure;
• deciding whether the project should continue when viability is questioned.

Accountability cannot be completely delegated, although tasks and decision authority can be delegated. The accountable executive must therefore remain sufficiently informed and engaged.

The project sponsor

The sponsor is the project’s senior champion and organisational enabler. In smaller projects the sponsor and accountable executive may be the same person. In complex projects they may be distinct. The sponsor translates organisational intent into practical support, protects the project from avoidable political obstruction and ensures that decisions are made promptly.

A sponsor should:

• articulate the project’s purpose and success criteria;
• maintain alignment with strategy and the investment case;
• remove organisational barriers;
• chair or support the steering group;
• make decisions within delegated authority;
• secure stakeholder commitment;
• communicate difficult decisions and defend justified changes;
• ensure that transition and benefits realisation are owned.

An ineffective sponsor is often visible through delayed decisions, weak stakeholder mobilisation and a project manager who must repeatedly negotiate issues that require executive authority. Sponsorship is an active leadership role, not merely a name on the charter.

The steering group or project board

A steering group is a collective governance body representing the interests needed to direct the project. Its membership should be limited enough to decide efficiently but broad enough to represent strategic, operational, financial, technical, customer and risk perspectives.

Its responsibilities may include approving the charter, confirming stage plans, reviewing performance, resolving escalated conflicts, approving material changes and authorising progression through gates. It should not become a routine status-meeting audience. Every meeting should have decision-oriented information, clear recommendations and recorded actions.

Members are not delegates who defend only their functional interests. They owe a duty to the project’s authorised purpose and should disclose conflicts of interest.

The project manager

The project manager is accountable for managing delivery within approved authority. Core responsibilities include developing plans, coordinating resources, managing risks and issues, controlling changes, maintaining records and providing truthful information to governance bodies.

The project manager should have sufficient delegated authority to avoid unnecessary escalation. Excessive centralisation slows delivery; excessive delegation weakens control. The charter should therefore state what the project manager may decide independently and what requires sponsor, board or corporate approval.

Assurance and independent advisers

Assurance provides an informed, independent or semi-independent assessment of whether governance, plans, controls and delivery remain credible. Assurance may examine business-case realism, risk exposure, procurement, architecture, cybersecurity, quality, benefits or readiness for transition.

Assurance does not replace management responsibility. An assurance reviewer identifies evidence and challenges assumptions; the accountable executive decides how to respond.

3. Decision Rights and Accountability

Decision rights specify who may decide, who must be consulted, who provides advice and who must be informed. They should be defined before major decisions arise. Ambiguous authority produces either decision paralysis or unauthorised commitments.

A practical accountability model is RACI:

• Responsible: performs or coordinates the work.
• Accountable: owns the outcome and has final authority.
• Consulted: provides information or professional advice before the decision.
• Informed: receives the decision or progress information.

There should normally be one clearly identifiable Accountable role for a decision. Several people may be Responsible, Consulted or Informed. RACI is not a substitute for judgement: it must be supplemented by thresholds, timing and escalation rules.

The exact allocation depends on organisational structure and project scale. What matters is that the charter records the arrangement and that it is understood by affected stakeholders.

Decision-rights design principles

1. Proximity: decisions should be made as close as practical to the information and work.
2. Materiality: decisions with greater strategic, financial, legal or reputational impact require higher authority.
3. Competence: technical decisions should be informed by qualified specialists.
4. Independence: assurance and approval should be separated where self-review would create unacceptable bias.
5. Traceability: significant decisions should record the issue, alternatives, rationale, authority and consequences.
6. Timeliness: decision rights should include response times, not merely titles.

4. Governance Structures and Design Choices

There is no universally correct governance structure. Design should reflect project complexity, uncertainty, regulatory exposure, stakeholder diversity, organisational maturity and the consequences of failure.

A small internal project might use one sponsor and a monthly review. A national infrastructure programme may require an executive board, technical authority, risk committee, benefits forum, independent assurance and formal external reporting. More committees do not necessarily mean better governance. Each body should have a distinct purpose, authority and decision calendar.

A typical structure is:

Figure: A representative project governance hierarchy. Actual structures should be adapted to context.

A governance design should specify membership, chairing, quorum, voting or consensus rules, delegated authority, meeting frequency, information requirements, conflicts-of-interest arrangements and records management. It should also identify substitutes for key members so that governance does not fail when one individual is unavailable.

5. Tolerances, Escalation and Exception Management

A tolerance is the permitted deviation from an approved baseline before escalation or reauthorisation is required. Typical dimensions include cost, time, scope, quality, risk exposure, benefits, safety and regulatory compliance.

Tolerances are not permission to consume the entire margin. They are boundaries within which the authorised manager may act, provided the business case remains credible.

For example, a charter may establish the following tolerances:

A tolerance should be measurable and linked to a baseline. If the original baseline is unreliable, apparent tolerance compliance may be misleading. Tolerance management therefore requires credible estimates, consistent definitions and timely forecasting.

An escalation path should state:

1. how an issue is detected and recorded;
2. who initially assesses it;
3. the maximum time for response;
4. which authority receives it when tolerance is threatened;
5. what information and recommendation must accompany escalation;
6. how the decision is recorded and communicated.

Escalation is not failure. Early escalation is a control mechanism. The cultural aim should be “no surprises,” not the artificial appearance that all work remains on plan.

6. Stage Gates and Continuing Authorisation

A stage gate is a formal decision point at which governance authorities determine whether a project should proceed, be modified, paused or stopped. Gates prevent an early approval from becoming an irreversible commitment despite changed circumstances.

A robust gate review considers:

• continued strategic alignment;
• evidence of deliverables and readiness;
• updated cost, schedule and benefit forecasts;
• residual risk and risk responses;
• stakeholder and operational readiness;
• compliance, safety and security evidence;
• lessons from the completed stage;
• the quality of the next-stage plan.

Typical gates include concept approval, initiation approval, design approval, build or implementation approval, operational readiness and post-implementation review. Agile delivery does not eliminate governance gates; it may replace large infrequent gates with evidence-based product increments, funding reviews and outcome checkpoints.

A gate decision should be one of the following:

• Proceed: evidence supports continuation within the approved mandate.
• Proceed with conditions: continuation is authorised subject to specified actions.
• Replan or rebaseline: the project remains viable but requires formal change.
• Pause: work is temporarily stopped pending evidence or a decision.
• Terminate: continuation is not justified.

Stopping a project is not necessarily poor performance. A disciplined termination may preserve value by preventing further expenditure on an obsolete, unsafe or uneconomic proposition.

7. Assurance, Reporting and Information Quality

Governance quality depends on the quality of information available to decision makers. Reports should be timely, comparable, decision-oriented and candid about uncertainty. A dashboard that reports only completed activities may conceal deteriorating benefits, unresolved dependencies or increasing technical debt.

An effective governance pack normally includes:

• status against approved outcomes and milestones;
• forecast cost and schedule, not only historical actuals;
• top risks and issues with owners and response dates;
• changes requested and their effects;
• decisions required from the governing body;
• benefits and dis-benefits evidence;
• quality, safety, privacy and security indicators;
• stakeholder and readiness information.

Assurance can be arranged in layers:

1. Management control: reviews performed by the project team.
2. Sponsor oversight: challenge and review by the sponsor or steering group.
3. Independent assurance: review by people sufficiently separate from delivery.
4. Audit or regulatory review: formal examination against organisational or external requirements.

Independence is contextual. A technical specialist from another department may provide useful challenge, but may not be independent if they benefit from the project’s approval. Assurance reports should distinguish facts, assumptions, judgements and recommendations.

8. Ethical, Regulatory and Digital Governance Issues

Governance creates ethical obligations. Decision makers should avoid conflicts of interest, disclose material relationships, protect confidential information and ensure that affected stakeholders are not excluded merely because they have less organisational power. Consultation should be meaningful rather than symbolic.

Projects involving personal data, automated decisions, critical infrastructure or public services require particular care. Governance should address lawful processing, data minimisation, access control, retention, explainability and accountability. A project should not treat legal approval as proof that an outcome is ethically acceptable.

Artificial intelligence can support risk sensing, document analysis, forecasting and decision preparation. It should not silently replace accountable human judgement in high-consequence decisions. AI-enabled governance requires attention to data quality, model bias, explainability, cybersecurity, supplier dependence and audit trails. A generated recommendation must be identifiable as a recommendation, with a human decision owner and documented rationale.

Contemporary governance is also increasingly concerned with sustainability, supply-chain resilience, climate exposure and digital continuity. These issues should be incorporated into the business case, risk appetite, stage gates and benefits review rather than treated as separate public-relations activities.

9. Worked Application: The Integrated Patient Records Project

The following is an illustrative case.

Background

A regional health authority proposes an integrated electronic patient-record system across three hospitals. The expected benefits are improved clinical information access, reduced duplicate testing and stronger continuity of care. The project involves clinical staff, information technology, procurement, privacy specialists, patients and an external supplier.

Problem

The initial proposal assigned approval authority to a large committee but did not define who owned benefits, who could approve design changes or how privacy concerns would be escalated. Clinical representatives feared that technical decisions would ignore workflow realities. The supplier sought rapid configuration decisions, while the privacy office required additional evidence.

Analysis

The project has high stakeholder diversity, safety implications, personal-data risks and substantial organisational change. A single undifferentiated committee would be too slow for operational decisions but insufficiently specialised for clinical safety and privacy. The governance design therefore needs layered authority.

Approach

The authority establishes:

• an accountable executive responsible for the investment and continuation decision;
• a sponsor who chairs the steering group and owns organisational mobilisation;
• a project manager with authority over integrated delivery within agreed tolerances;
• a clinical and safety authority with approval rights over clinical workflow and safety requirements;
• a privacy and security review function with mandatory consultation and escalation rights;
• an independent assurance review before pilot deployment and before full rollout;
• hospital-level readiness owners accountable for adoption and benefits realisation.

The steering group approves the charter, stage plans, material scope changes and rollout decisions. The project manager may approve detailed configuration within the approved requirements and tolerances. Any change affecting patient safety, statutory privacy obligations or the benefits case must be escalated regardless of cost.

The project uses gates for design approval, pilot readiness, pilot evaluation and full deployment. At the pilot gate, the board requires evidence of training, incident procedures, data migration testing, clinical safety assessment and user acceptance. A dashboard reports forecast cost, unresolved defects, adoption measures, privacy actions and readiness by hospital.

Outcome

The pilot reveals that the system meets technical requirements but creates delays in emergency admissions. The steering group pauses expansion, commissions a workflow redesign and revises the benefit forecast. Because the gate and escalation rules were explicit, the pause is treated as responsible governance rather than project failure. A later controlled rollout improves adoption and preserves the safety objective.

Learning points

The case demonstrates that governance must be designed around consequences, not organisational convenience. It also shows that decision rights should follow expertise and accountability: clinical safety decisions cannot be reduced to ordinary configuration choices, and benefits cannot be assumed to arise automatically from technical delivery.

10. Common Governance Failures and Better Practice

Symbolic sponsorship

A sponsor who attends launch events but does not resolve conflicts provides visibility without authority. Better practice is to define sponsor commitments, decision availability and escalation responsibilities in the charter.

Committee inflation

Too many committees create duplicated reporting and slow decisions. Better practice is to map each body to a distinct purpose and eliminate forums that have no decision rights.

Micromanagement

A board that approves minor tasks consumes governance capacity and weakens the project manager. Better practice is to use tolerances and exception reporting.

Optimism and suppressed bad news

Political pressure may cause teams to delay escalation. Better practice is to reward early disclosure, show forecast ranges where uncertainty is material and require independent challenge.

RACI without authority

A matrix can identify roles while leaving approval thresholds unclear. Better practice combines RACI with monetary, schedule, risk and compliance thresholds.

Benefits without owners

If benefits are described only in the business case, no one may be accountable after delivery. Better practice assigns operational benefits owners and schedules post-implementation measurement.

Governance copied without adaptation

A framework designed for a major infrastructure project may overwhelm a small initiative. Conversely, informal arrangements may be unsafe for regulated work. Better practice tailors governance proportionately while preserving essential accountability, transparency and assurance.

Best-Practice Design Checklist

Before approving a project charter, confirm that:

• the accountable executive and sponsor are named;
• the strategic rationale and desired outcomes are explicit;
• governance bodies have defined membership, authority and cadence;
• decision rights and delegated limits are documented;
• tolerances are measurable and linked to baselines;
• escalation routes and response times are agreed;
• stage gates have evidence requirements and possible decisions;
• assurance is proportionate and sufficiently independent;
• benefits owners exist beyond the project team;
• conflicts, ethics, privacy, security and regulatory duties are addressed;
• reporting distinguishes facts, forecasts, assumptions and decisions;
• the project can be paused or terminated without stigma.

Chapter Summary

Project governance is the system through which a temporary investment is directed, authorised and held accountable. It differs from project management: governance sets direction, authority and control boundaries, while management coordinates delivery within those boundaries. Effective governance depends on active sponsorship, a proportionate steering arrangement, explicit decision rights, measurable tolerances and timely escalation.

Stage gates provide continuing authorisation rather than one-time approval. Assurance challenges the credibility of plans and information without taking ownership away from management. RACI can clarify participation, but it must be combined with thresholds, authority and traceable decisions. Ethical, regulatory, privacy, security and sustainability issues belong within governance, particularly where projects affect people or use automated systems. The central principle is that authority should be clear, decisions should be timely and accountability should remain visible from initiation through benefits realisation.

Key Terms

Governance: The framework of authority, accountability, decision rights, controls and assurance directing a project.

Project management: The planning, coordination and control of work to deliver approved objectives.

Sponsor: The senior organisational champion who enables, supports and represents the project.

Accountable executive: The person ultimately answerable for the investment and its continuation.

Steering group: A governance body that provides direction, oversight and material decisions.

Decision rights: Explicit authority to make specified decisions.

RACI: A role model identifying Responsible, Accountable, Consulted and Informed parties.

Tolerance: Permitted deviation from an approved baseline before escalation.

Escalation: The referral of a matter to a higher authority because it exceeds mandate or requires intervention.

Stage gate: A formal review point at which continuation is authorised, conditioned, paused or stopped.

Assurance: Independent or semi-independent assessment of governance, controls, plans or delivery credibility.

Baseline: An approved reference point for comparison, such as scope, cost or schedule.

Business case: The structured justification for undertaking an investment.

Benefits owner: The person accountable for achieving and measuring a benefit.

Exception: A situation in which forecast performance exceeds an approved tolerance.

Risk appetite: The amount and type of uncertainty an organisation is willing to accept.

Quorum: The minimum authorised attendance required for a valid governance decision.

Traceability: The ability to connect a decision to its evidence, authority, rationale and consequences.

Review Questions

Short Answer Questions

1. How does project governance differ from project management?
2. What are the principal responsibilities of a project sponsor?
3. Define tolerance and explain why it is useful.
4. What is the purpose of a stage gate?
5. Why is independent assurance different from project management control?

Long Answer Questions

1. Explain how an organisation should design governance for a complex, regulated project.
2. Critically evaluate the usefulness and limitations of the RACI model.
3. Discuss how sponsors, steering groups and project managers should interact without creating either gaps or micromanagement.
4. Explain how stage gates and escalation mechanisms support continuing investment decisions.
5. Analyse the ethical and regulatory responsibilities of governance bodies in projects involving personal data and artificial intelligence.

Analytical / Application Questions

1. A project is forecast to exceed its approved budget tolerance by 6%, but all strategic benefits remain credible. Design the escalation, information and decision process that should follow.
2. Create a decision-rights and governance structure for a cross-organisational digital transformation involving cybersecurity, privacy and operational change.
3. A steering group receives consistently positive reports, but independent assurance identifies unresolved safety risks. Analyse the governance failure and recommend corrective actions.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from project management?

A. Governance coordinates daily tasks, while project management approves strategy.

B. Governance sets direction and accountability, while project management manages delivery within approved boundaries.

C. Governance is required only for regulated projects.

D. Project management has final authority over all investment decisions.

Correct Answer: B. Governance sets direction and accountability, while project management manages delivery within approved boundaries.

Question 2

Which role is primarily responsible for removing organisational barriers and championing the project?

A. Project sponsor

B. External auditor

C. Work-package coordinator

D. Procurement analyst

Correct Answer: A. Project sponsor

Question 3

In a RACI model, who owns the final outcome of a decision?

A. Responsible

B. Consulted

C. Accountable

D. Informed

Correct Answer: C. Accountable

Question 4

What is the principal purpose of a tolerance?

A. To eliminate all project risk

B. To permit defined variation before escalation is required

C. To replace the project baseline

D. To transfer accountability to the supplier

Correct Answer: B. To permit defined variation before escalation is required

Question 5

Which is an appropriate possible outcome of a stage gate?

A. Automatic continuation regardless of evidence

B. Deletion of all project records

C. Pause or termination when continuation is not justified

D. Delegation of all governance to the project team

Correct Answer: C. Pause or termination when continuation is not justified

Question 6

Why should a governance body avoid approving minor operational tasks?

A. It increases micromanagement and slows decisions.

B. It makes assurance independent.

C. It removes the need for a sponsor.

D. It guarantees benefits realisation.

Correct Answer: A. It increases micromanagement and slows decisions.

Question 7

Which information is most useful for decision-oriented governance reporting?

A. Only activities completed since the previous meeting

B. Forecast performance, material risks, decisions required and effects of changes

C. A list of every email sent by the project team

D. Only the original business-case assumptions

Correct Answer: B. Forecast performance, material risks, decisions required and effects of changes

Question 8

What is the correct principle concerning accountability and delegation?

A. Accountability can always be fully transferred by naming a deputy.

B. Tasks and authority may be delegated, but ultimate accountability remains with the accountable role.

C. Only the project manager can hold accountability.

D. Assurance providers automatically become accountable for outcomes.

Correct Answer: B. Tasks and authority may be delegated, but ultimate accountability remains with the accountable role.

Question 9

Which situation most clearly requires escalation regardless of cost tolerance?

A. A minor formatting change in a report

B. A routine task completed one day early

C. A potential breach of mandatory safety or privacy requirements

D. A supplier meeting held ahead of schedule

Correct Answer: C. A potential breach of mandatory safety or privacy requirements

Question 10

What is a key governance requirement when artificial intelligence supports project decisions?

A. The system should make high-consequence decisions without human review.

B. Recommendations should have a clear human decision owner and an auditable rationale.

C. Model outputs should never be challenged by assurance.

D. Data quality is irrelevant if the model is commercially supplied.

Correct Answer: B. Recommendations should have a clear human decision owner and an auditable rationale.