Project governance: structures and decision rights

Governance is the framework of authority, accountability and oversight within which a project operates. It answers questions that every project eventually faces: who can approve this, who must be told, what happens if we exceed our limits, how will we know the project is succeeding and who can stop it? The first Business Environment task in the 2026 outline is to define and establish project governance: setting up structure, rules, procedures, reporting, ethics and policies, using the organization's process assets, defining success measures and setting escalation paths and thresholds. The PMBOK Guide, eighth edition, lists governance as one of its seven performance domains, which signals how central it has become.

Governance and management are different

Governance decides direction and sets limits; management works within them. A useful way to remember the difference is that governance is about doing the right things in the right way, and management is about doing things right. The board that approves Eastgate's budget, the sponsor who holds the management reserve and the change control board that approves mid-sized changes are governance. The project manager who plans the work, coordinates the team and reports progress is management, though project managers also take part in governance by preparing information and recommendations.

Who is who in project governance

Most project governance structures draw on a small set of roles. Their names vary, but their purposes are consistent.

• The governing board or executive (for Larkfield, the library board) approves the investment, sets the budget and decides on changes that exceed delegated limits.
• The sponsor champions the project, owns the business case, holds the management reserve and is the first escalation point beyond the project manager's authority. For Compass, the sponsor is the chief executive, Gloria Mensah.
• A steering committee or project board advises the sponsor and represents key interests: for Compass, the directors of finance and branch services, the IT manager and the facilities manager.
• A change control board (CCB) reviews and decides on changes within its delegated limits; PMP-131 set out its membership for Compass.
• A project management office (PMO) may set standards, provide tools and templates, support or audit projects, or directly manage them. PMOs are often described as supportive, controlling or directive depending on how much control they exercise.
• The project manager leads the project, manages day-to-day decisions within delegated authority and makes sure governance bodies receive the information they need.
• In adaptive work, the product owner holds decision rights over product scope and priority within limits set by governance.

Decision rights, thresholds and escalation

The heart of governance is a clear statement of who may decide what. Without one, small decisions wait for busy executives and large decisions get made quietly by people who should not make them. Decision rights are usually expressed as thresholds, sometimes called tolerances: limits of cost, time, scope, quality, risk or benefit within which a person may decide, beyond which the decision escalates. PMP-131 set out Compass's change authority levels. Here they are again as a governance rule, with an escalation path.

# Route a proposed change or variance to the right decision maker using the
# Project Compass authority levels (cost in dollars, delay in working days on the opening date).
def decide(cost, delay_days, uses_reserve=False, extra_funding=False, backlog_only=False):
    if backlog_only:
        return "Product owner (backlog, within release goal and budget)"
    if extra_funding:
        return "Library board, on the sponsor's recommendation"
    if uses_reserve or cost > 50_000 or delay_days > 5:
        return "Sponsor, advised by the change control board"
    if cost >= 10_000 or delay_days > 0:
        return "Change control board"
    return "Project manager, reported at the next CCB meeting"
cases = [("Swap carpet tile shade, no cost", 0, 0, {}),
         ("Extra data drops in the study rooms", 8_400, 0, {}),
         ("Fire panel upgrade required by the inspector", 31_000, 3, {}),
         ("Kiosk tariff increase drawn from reserve", 19_000, 0, {"uses_reserve": True}),
         ("Add a children's sensory room", 165_000, 12, {"extra_funding": True}),
         ("Move room booking to release 1.1", 0, 0, {"backlog_only": True})]
for label, cost, days, flags in cases:
    print(f"{label:46} -> {decide(cost, days, **flags)}")

Swap carpet tile shade, no cost                -> Project manager, reported at the next CCB meeting
Extra data drops in the study rooms            -> Project manager, reported at the next CCB meeting
Fire panel upgrade required by the inspector   -> Change control board
Kiosk tariff increase drawn from reserve       -> Sponsor, advised by the change control board
Add a children's sensory room                  -> Library board, on the sponsor's recommendation
Move room booking to release 1.1               -> Product owner (backlog, within release goal and budget)

The routing is mechanical once the thresholds are clear, which is exactly the point: nobody needs to argue about who decides. The fire panel upgrade, required by the inspector and costing $31,000 with a three-day delay, goes to the CCB. The kiosk tariff increase is small, but because it draws on the management reserve it goes to the sponsor. The sensory room needs new money, so only the board can approve it, however much the sponsor supports it. Moving room booking to a later release stays with the product owner, because it changes neither the goal nor the budget.

Success measures and reporting

Governance needs a shared definition of success, set early and agreed by the sponsor. Success criteria usually go beyond schedule and budget to include scope, quality, stakeholder satisfaction, compliance and benefits. For Compass, the board agreed that success meant opening by the start of the autumn programming season, within the $2.52 million budget, with the app's release 1 meeting the accessibility standard, no unresolved safety or privacy findings, and a benefits register handed to the branch manager with agreed targets. Note that some criteria judge the project at closure, while others, such as visits, are benefits judged later.

Reporting is how governance stays informed. Good governance reporting is short, regular, honest and focused on decisions: what has changed, what is at risk, what decisions are needed and by when. A common format is a one-page dashboard with status against key measures (often red, amber or green), top risks and issues, decisions required and a forecast. Compass's monthly board pack included earned value indicators from the predictive workstreams, the release burn-up from the app, the top five risks, open compliance items and benefits readiness.

Organizational process assets and policies

Projects do not invent governance from nothing. Organizations provide organizational process assets: policies, procedures, templates, standards, historical information and lessons learned. For Compass these included the library's purchasing policy, the records retention schedule, the privacy policy, the project management standard issued by the city's PMO, a business case template and lessons from the last branch renovation. Using these assets saves time and keeps the project consistent with how the organization works; part of setting up governance is deciding which apply and whether any need tailoring.

Policies also carry ethical expectations. PMI's Code of Ethics and Professional Conduct, which PMP holders agree to follow, rests on four values: responsibility, respect, fairness and honesty. In governance terms, these mean reporting status truthfully, disclosing conflicts of interest, respecting confidentiality and decision rights, and not hiding problems from the people entitled to know about them.

Gates and governance in predictive projects

Predictive projects often use phase gates (also called stage gates or decision points): reviews at the end of a phase where a governance body decides whether to continue, change direction or stop, based on deliverables, updated business case, risks and readiness for the next phase. Compass's fit-out used four gates: approval of the business case, approval of design and budget before tendering, approval to award the construction contract, and acceptance and readiness to open.

Gates work best when they ask whether the project is still worth doing, not just whether the paperwork is complete. A gate that only checks documents encourages teams to produce documents. A gate that asks what has changed in the business case, what the biggest risks are and whether the organization is ready for the next step encourages good decisions.

Designing governance that fits

Governance should be proportionate to the project's size, risk, complexity and regulatory exposure. Too little governance lets problems grow unseen and decisions drift to the wrong people. Too much governance slows everything, buries the team in reports and pushes decisions to people too far from the work to judge them well. Signs of over-governance include long approval queues for small decisions, multiple bodies reviewing the same thing and reports nobody reads. Signs of under-governance include unclear sponsorship, surprise overruns, and teams that do not know whom to ask.

When setting up governance, the project manager typically works with the sponsor to agree the governance bodies and their members, decision rights and thresholds, the escalation path, success criteria and measures, reporting format and frequency, gate criteria if any, and which organizational policies and assets apply. The result is recorded in a governance section of the project management plan or a separate governance plan, and reviewed if the project changes significantly.