Commercial Controls Diagnostic

Select the statement that most honestly describes your programme's current position. There are no right answers to aim for: an accurate picture is more useful than an optimistic one.

D3 · Commercial and Contractual

Q1. How well does your contract form reflect the programme's risk profile?

Level 1 No documented rationale. The contract form was selected without reference to the programme's risk profile. Level 2 Some consideration given to risk allocation but not formally documented or independently reviewed. Level 3 Contract form selected with a documented rationale and legal review. Risk allocation is clear. Level 4 Contract form and risk allocation actively reviewed and managed through delivery. Incentive mechanism is working as intended. Level 5 Fully embedded, independently verified, and would withstand external scrutiny without remedial work.

D3 · Commercial and Contractual

Q2. How well are compensation events and change being managed?

Level 1 No formal change control. Compensation events are not tracked or assessed within contractual timescales. Level 2 A CE log exists but is incomplete. Assessments are often late or becoming disputed. Level 3 CE log is current and assessments are issued within contractual timescales. The change process is followed consistently. Level 4 CE management is proactive. Early warnings are used as intended and the commercial position is understood at all times. Level 5 No backlog. No warehoused disputes. Commercial position independently verified and resilient to challenge.

D3 · Commercial and Contractual

Q3. How effectively is your programme using the early warning process?

Level 1 No early warning process in use. Problems surface late, as cost or delay events. Level 2 An early warning register exists but is not maintained or reviewed regularly at meetings. Level 3 Early warning register maintained and reviewed at each meeting. Issues escalated to the right level. Level 4 Both parties raise early warnings proactively. The register is linked to the risk register and drives action. Level 5 Fully embedded, auditable, and demonstrably reducing cost and delay risk on the programme.

D4 · Cost Certainty and Estimating

Q4. How mature and reliable is your programme's cost estimate?

Level 1 No documented basis of estimate. The cost figure cannot be reconciled to defined scope. Level 2 An estimate exists but the basis is not documented. It has not been benchmarked against comparable programmes. Level 3 Estimate documented, benchmarked, and appropriate for the programme stage. Optimism bias considered. Level 4 Estimate regularly updated. Cost to complete is actively managed and reported with sufficient rigour. Level 5 Independently verified. Forecast has a track record of accuracy and would withstand external scrutiny.

D4 · Cost Certainty and Estimating

Q5. How well is contingency governed and protected?

Level 1 No contingency, or contingency is not separately identified or governed. Level 2 Contingency is included but not derived from a quantified risk assessment. Drawdown is not tracked. Level 3 Contingency derived from a quantified risk assessment, held centrally, and released only with approval. Level 4 Drawdown tracked against the risk register. Remaining contingency is understood in the context of remaining exposure. Level 5 Independently verified. Governance is robust and auditable. The contingency position is fully defensible.

D8 · Controls, Reporting and Data

Q6. Does your reporting give an accurate picture of programme status?

Level 1 No consistent reporting suite. The board and SRO receive no structured programme data. Level 2 Reporting exists but is inconsistent. It is known to be optimistic or incomplete in key areas. Level 3 Consistent reporting suite covering cost, time, and risk. Used to manage the programme, not just to report. Level 4 Reporting is measured, reviewed, and improved. Data quality is actively governed and known gaps are flagged. Level 5 Independently assured. Accurate, timely, and demonstrably free of systematic optimism bias.

D8 · Controls, Reporting and Data

Q7. How clear are your programme's decision rights and governance structure?

Level 1 No defined governance structure. Decision rights are unclear or contested. Level 2 A governance structure exists on paper but is not consistently applied in practice. Level 3 Governance is defined, documented, and followed. The SRO is clearly accountable and engaged. Level 4 Governance is actively reviewed. A three-lines model operates and assurance findings are tracked to closure. Level 5 Independently assured. Resilient and fully auditable under external scrutiny.

Overall

Q8. Overall, how confident are you that your programme is genuinely in control?

Level 1 Not confident. The programme is in difficulty and the controls are not working. Level 2 Limited confidence. There are known gaps in control but they have not been formally addressed. Level 3 Reasonable confidence. Controls are in place and working but have not been independently verified. Level 4 Good confidence. Controls are strong, the programme is actively managed, and risk is well understood. Level 5 High confidence. Controls are robust, independently assured, and resilient to external scrutiny.

Where should we send the gap analysis?

Your responses and contact details are treated in confidence and used only to prepare and send your gap analysis.

Name

Organisation

Role

Email address

Programme or project (optional)

We will use your details only to send your gap analysis and, if relevant, to follow up with a brief conversation. See our privacy notice.

Please answer all eight questions before submitting.

How well controlled is your programme?

Answer eight questions.

Submit your details.

Receive a gap analysis.

Rate your programme.

Q1. How well does your contract form reflect the programme's risk profile?

Q2. How well are compensation events and change being managed?

Q3. How effectively is your programme using the early warning process?

Q4. How mature and reliable is your programme's cost estimate?

Q5. How well is contingency governed and protected?

Q6. Does your reporting give an accurate picture of programme status?

Q7. How clear are your programme's decision rights and governance structure?

Q8. Overall, how confident are you that your programme is genuinely in control?

Where should we send the gap analysis?