Project governance and management: roles, steering, earned value and project risk

Many IT failures are project failures: systems delivered late, over budget, missing key controls or not delivering the benefits promised in the business case. Project governance makes sure projects are justified, directed and monitored by the right people, and project management delivers them. The IS auditor checks that both work, often during the project rather than after, when problems are still cheap to fix. Key roles include the project sponsor, a senior business leader who owns the business case, provides funding and direction and is accountable for realizing benefits; the project steering committee, which makes major decisions and approves changes to scope, budget or schedule beyond the project manager's authority; the project manager, who plans and runs day-to-day work and reports status; the project management office (PMO), which sets methods and standards and tracks the portfolio of projects; and users and system owners, who define requirements and accept the result. Quality assurance, security and risk staff advise on standards and controls. An IS auditor may participate to advise on controls, but must not take a decision-making role that would compromise independence later.