M6.4 — Assurance & Control Reviews

M6.4 — Assurance & Control Reviews

1. Practical outcome

The learner should be able to plan and conduct a proportionate review of project-controls data, processes and outputs; test evidence against stated criteria; identify material weaknesses; communicate their consequences; and verify corrective action. They should distinguish management review, quality checks and independent assurance, and express a conclusion that is bounded by what was actually examined.

M6.1 defines the controls operating model and M6.2/M6.3 govern decisions and their implementation. M6.4 tests whether those arrangements can be relied upon for the relevant decision. It examines both control design and operation: a procedure can be adequate on paper yet fail at the point of use, and a plausible output can be produced by a weak process.

Ask: “What reliance is management placing on this information, what evidence would justify that reliance, and what could materially change the decision?”

2. Core concepts

Purpose, criteria and scope come before testing

State the review question, decision, period, systems and outputs covered. A pre-opening readiness review, a baseline release check and a cost-close assurance review have different criteria and evidence needs. Define what will be tested, what will not, and the consequences of unavailable information.

Criteria can come from approved requirements, the controls plan, contractual information obligations, baseline-release rules and established methods. Cite their actual versions. A reviewer should not impose an unstated personal preference as a formal non-compliance. Where the criterion is missing, report the governance weakness and explain why it matters rather than inventing a rule after the test.

Management review, quality control and assurance

Management reviews performance and chooses action. Quality control checks whether particular data or outputs meet defined requirements. Assurance evaluates whether processes, controls and evidence provide a justified level of reliance. Independent assurance adds separation from the people responsible for the activity being reviewed.

These activities can support each other but are not interchangeable. A monthly meeting that discusses an EAC does not necessarily test its source data or inclusion boundaries. A peer arithmetic check does not establish that the remaining scope is complete. Define the competence, independence and access appropriate to the consequences of the decision.

Design and operating effectiveness

Test design by asking whether the control, if followed, would address the relevant risk. For example, a release checklist that checks filenames but never verifies budget totals may fail to prevent an unauthorised increase. Test operation by examining whether the control was applied, by whom, when, to which evidence and with what result.

Do not rely solely on interviews or a completed checkbox. Trace transactions and outputs back to sources, reperform selected calculations and inspect evidence of challenge and closure. A consistent process can still consistently use the wrong acceptance definition, so outcome and method both need examination.

Risk-based selection and sampling

Focus additional effort on high-consequence interfaces, new or changed controls, unreliable sources, prior findings, manual overrides and estimates that drive a decision. Within the defined scope, test all mandatory critical gates when practical, then select a justified sample of other records. State the population and sampling approach.

A purposeful sample is useful for finding weaknesses but does not automatically support a statistical error rate. Finding no defects in five selected records does not prove that all records are accurate. If a defect appears systemic, expand testing sufficiently to understand its extent and consequence rather than treating it as an isolated correction without evidence.

Evidence, reproducibility and limitations

Relevant evidence can include approved versions, source registers, test records, cost ledgers, accrual support, change approvals, schedule exports, interface logs and decision/action records. Assess provenance, date, completeness and consistency. Screenshots may show a reported state but often lack the inputs needed to reproduce a calculation.

Record the exact files, query boundaries, cut-offs and methods used. Separate observed fact from inference and untested assumption. If access is restricted or evidence missing, qualify the conclusion. Absence of evidence is not proof that a control never operated, but it may mean the required reliance cannot be demonstrated.

Materiality and consequence

Materiality depends on the decision and objective, not only value. A small arithmetic difference may be immaterial to a rounded portfolio report but material to an approval limit. A zero-cost configuration defect can prevent opening. Consider scale, likelihood, urgency, affected objective and whether the issue is isolated or systemic.

Use an agreed finding-rating method, with explicit reasoning. Do not count ten minor formatting observations as more significant than one missing readiness gate. The finding should state the criterion, observed condition, evidence, cause where supported, consequence and required corrective outcome.

Corrective action and verified closure

Assign an accountable owner, due point and required evidence. Distinguish immediate containment from permanent correction and prevention of recurrence. Correcting one EAC cell may contain a report error; correcting the interface rule and testing other changes addresses the process weakness.

Closure requires the stated outcome to be demonstrated. “Procedure updated” or “owner says completed” may be insufficient. Reperform the affected check and verify first use, with independence proportionate to the original finding. Retain residual risks, overdue actions and any approved acceptance of an unresolved issue.

Conclusions are bounded

A review can conclude that specified controls operated satisfactorily within the tested scope, subject to limitations or actions. It should not declare the entire project assured from a limited test. Approval remains with the decision-maker. Reviewers should communicate a material problem promptly while preserving a balanced account of the evidence and what remains uncertain.

Assurance also supports learning. Look for repeated causes across periods and suppliers, unclear definitions and incentives that encourage concealment. Improve criteria and operating design without rewriting previous findings or using the number of closed actions as a substitute for control effectiveness.

3. Step-by-step method

1. Define the reliance and decision. Identify who needs assurance, about which output or process, for what purpose and by when.

2. Establish scope and criteria. Confirm periods, systems, baseline/configuration versions, populations, obligations and exclusions.

3. Confirm competence, independence and access. Identify conflicts, specialist support, unavailable evidence and the consequences for the review conclusion.

4. Assess risks and plan tests. Prioritise critical gates, changed controls, unreliable interfaces, manual overrides and previous findings; justify the sample.

5. Collect and preserve evidence. Record provenance, versions, cut-offs and completeness; distinguish originals from reviewer working copies.

6. Test design and operation. Trace controls through actual transactions, inspect approvals and challenge evidence, and reperform material calculations.

7. Test integrated outputs. Reconcile scope, schedule, cost, risk, progress and readiness assumptions; examine whether headline results conceal exceptions.

8. Investigate defects proportionately. Establish extent and supported causes, expand testing where necessary and distinguish isolated errors from systemic weaknesses.

9. Develop findings and discuss facts. Agree factual accuracy with owners without surrendering independent judgement; record unresolved disagreement fairly.

10. Communicate consequences and actions. Use agreed materiality, owners, deadlines, containment and verification criteria; escalate urgent issues before decisions are made.

11. Issue a bounded conclusion. State what was tested, findings, limitations and the implications for reliance or release; keep approval responsibility explicit.

12. Verify closure and learn. Reperform affected tests, confirm first use and remaining exposure, retain history and feed repeated causes into the controls strategy.

4. Worked Reference Project example — Community & Learning Centre

Context — review reliance on the first B02 report

Use the CR-M6-01 branch from M6.2/M6.3. Intended controlled values are project budget 50.000m CU, Technology budget 4.000m CU, central contingency 1.600m CU and working EAC 49.710m CU. Readiness in this branch is forecast five working days before opening; updated probabilistic confidence has not yet been established.

The Project Director requests assurance that the first B02 report and implementation records support the next readiness decision. The following defects are deliberately introduced into a review copy for this exercise; they are not extra changes to the correct worked values or events assumed to have occurred in other chapters.

Step A — define review scope and tests

The reviewer checks the approved CR-M6-01 decision and conditions, B02 manifest, transfer ledger, ETC/change reconciliation, relevant schedule path, acceptance/test configuration and report references. All critical acceptance/configuration gates associated with the enhancement are tested. Five other non-critical report records are selected purposefully to explore mapping quality; this sample is not used to estimate a population error rate.

Criteria are the approved change boundary, controls-plan role/authority rules, release checks and defined acceptance conditions. The reviewer records that legal entitlement and the detailed adequacy of specialist electrical design are outside this controls review and identifies the competent technical authority whose acceptance evidence is required.

Step B — identify and explain findings

Correct EAC is 49.710m CU, not 49.910m CU. Correct deterministic headroom is 0.290m CU, not 0.090m CU. The correction removes the duplicate allowance; it does not create a saving or change the approved scope/budget.

F02 has no price in the table, but it can determine readiness and therefore warrants urgent treatment. F03 is a presentation and evidence-boundary failure with a substantive decision consequence, rather than a cosmetic wording observation. Ratings follow the project's defined materiality criteria; the example does not invent a universal colour or scoring scale.

Step C — test extent and supported causes

For F01, the reviewer examines all approved/pending changes feeding the report to see whether the interface adds allowances already included in ETC. The review distinguishes an isolated manual duplication from a systematic mapping rule. It does not assume the cause until the interface and other records have been tested.

For F02, the reviewer checks the other critical enhancement tests and requirement links. A compatible filename is insufficient: the acceptance owner must confirm that the actual test conditions correspond to the released configuration. For F03, the reviewer examines all displayed confidence measures and their model dates to identify similar mixing.

The fact discussion records the report owner's explanation and any disagreement. If a source cannot be provided, the finding states the limitation and the resulting inability to demonstrate reliance, rather than asserting an undocumented motive.

Step D — assign correction and verification

The cost lead removes the duplicate exposure and reconciles the change-to-ETC mapping; the report/interface owner tests the rule on other changes. A peer checker reproduces the 49.710m CU EAC and 0.290m CU headroom from the retained sources before the corrected report is used.

The technical acceptance owner determines whether existing evidence can validly support the current configuration or whether retesting is required. Until valid evidence exists, the item remains unaccepted in readiness reporting. The controls team cannot close F02 by changing the label of an old test result.

The risk lead and report owner remove the implication of current 88% confidence, identify its historical model date and state that revised confidence is pending. That presentation correction can close the misleading-report finding once verified; the separate task to produce an updated risk assessment remains open. The action record should distinguish these outcomes.

Step E — issue a bounded conclusion

The reviewer concludes that reliance on the review-copy report is limited by the duplicate cost exposure, unsupported configuration acceptance and misleading confidence presentation. The recommendation is to correct and verify the report and keep the affected readiness gate unresolved until suitable technical evidence exists.

After F01 and the presentation part of F03 are verified, the reviewer may confirm those corrections. They should not declare the centre ready or the entire project assured while F02 remains unresolved. The Project Director receives the remaining consequence and next decision deadline; the acceptance owner and decision-maker retain their responsibilities.

5. Interpretation and professional judgement

A clean sample does not erase a critical defect

Five correct mapping records cannot outweigh an unsupported critical acceptance gate. Explain what the sample supports and what it does not. Conversely, one defect should not lead to an unsupported statement that all controls are unreliable; assess the population, interfaces and consequence.

Correction is not always closure

A changed number can repair a report while leaving the calculation route vulnerable. Verify the interface, ownership and next use when the cause is systemic. A presentation finding can close while a separately tracked underlying risk-assessment task remains open, provided the report no longer claims that work is complete.

Independence should improve the decision

Challenge facts, methods and evidence without turning the review into a negotiation over reassuring language. Preserve fair disagreement, limitations and positive evidence. The useful conclusion states what can be relied upon now and what must happen before the next decision.

6. Practice diagnostic

Use this table to challenge the quality of the approach or deliverable. The rows consolidate the most important recurring red flags and checks; they are prompts for professional judgement rather than a substitute for the method above.

7. Try-it-yourself practical exercise

Prepare the assurance plan, findings and conclusion for the B02 review copy.

·       1. Define the decision, scope, criteria and two exclusions, stating who covers the excluded technical/commercial questions.

·       2. Select six tests and explain why the critical configuration gate receives full examination.

·       3. Calculate the EAC and headroom corrections and explain why this is not a saving.

·       4. Write F02 as criterion, observed condition, evidence, consequence and required outcome without inventing a cause.

·       5. Describe how you would determine whether F01 is systemic and when sampling should expand.

·       6. Separate closure of misleading confidence presentation from completion of the revised uncertainty analysis.

·       7. Write a conclusion after F01 is corrected but current acceptance remains unsupported.

·       8. State how you would respond if the delivery owner asks you to mark all findings closed before the next meeting.

What good performance looks like

The report corrects EAC to 49.710m CU and headroom to 0.290m CU, preserves 50.000m CU budget and treats the correction as duplicate removal. The conclusion remains bounded; it identifies unresolved acceptance and pending updated confidence without assuming a new probability. Closure evidence includes reperformance and valid configuration acceptance, with competence and authority preserved.

Final challenge: “Does your review give management a defensible basis for reliance, or only a list of things you looked at?”

8. Bridge to capability

The How-to teaches how controls are tested and challenged through evidence. At APPLIED and above, capability assessment should test whether the practitioner can perform a realistic bounded review, substantiate findings and verify corrective outcomes. A proportionate review plan, reproducible tests and qualified conclusions should demonstrate the basis for reliance. Supporting work products are illustrative and should be assessed with the practitioner’s reasoning. Sample learning questions illustrate the judgement at each recognition level; they are discussion prompts rather than validated assessment items.

Learning question: Do you understand how control credibility is tested?

Capability question for APPLIED and above: Can you demonstrate a substantiated assurance conclusion, explain its limits and verify that material weaknesses were corrected?