Program governance

Program governance is the set of decision rights over a programme of related projects: who approves it, who funds it, who may change its scope and who has the authority to stop it. It is authority written down and then actually exercised.

Governance is not the plan. A program roadmap says what happens when; program governance says who gets to agree to it, who gets to change it, and what evidence they need in front of them before they do either.

Nor is it the office that administers the work. A project management office runs the mechanics of approved projects — governance is the authority that approved them and can withdraw that approval.

The test is simple. If nobody can name the person who is allowed to stop the programme, the programme does not have governance. It has meetings.

Key takeaways

• Program governance is decision rights: who approves, who funds, who changes scope and who stops the programme.
• The stop decision is the one most boards never define, and the one that costs most when it is missing.
• Write the thresholds down: which size of change needs whose signature, and inside what time.
• Judge governance by the decisions it takes on time, not by the number of meetings it holds.

How it works

Program governance works through a small number of named bodies with written thresholds. Each body gets a decision type, a quorum and a limit, so an issue only travels upward when it exceeds the limit below it. Everything else is settled where the work is.

The thresholds matter more than the bodies. A board with no limit written against it will either approve everything on sight or re-open decisions it already took — often both in the same quarter.

Most of this machinery exists elsewhere in the company already. Governance risk compliance covers the standing version across the whole organisation, and enterprise risk management supplies the scoring that tells a board what to escalate.

Decision rights only work when they come with a clock. A board that can approve anything but takes six weeks to do it has delegated the real decisions to whoever got tired of waiting.

Record the decision, not the discussion. A governance log naming what was decided, by whom and on which date is the one artefact that survives a change of sponsor.

Weak governance is visible at national scale. In February 2025, the U.S. Government Accountability Office (GAO) counted 38 areas on its High Risk List, three of which had regressed since its previous update.

Published rules give a board something to point at. The Office of Management and Budget (OMB) keeps its standing circulars in one index, including the circular making management responsible for internal control, revised in 2026.

Agile programmes need the same answers in a different shape. Agile portfolio management moves the funding decision onto a fixed review cycle rather than one business case, and somebody still has to hold the authority to stop a train.

Examples

Governance looks different by sector, and the clearest differences lie in who holds the stop decision and how quickly it can be taken once the evidence lands on the table.

In banking, a core systems replacement usually sits under a board subcommittee with a standing assurance review before each stage gate. The regulator will eventually ask who approved what and on which date, so the paperwork is part of the design.

In public sector programmes, the authority is often split between a sponsoring department and a central budget office — which is why those programmes stall at funding points rather than at technical ones.

Where delivery is outsourced, governance has to reach across the contract. Third party risk management brings the supplier inside the risk picture, and compliance program design sets the controls a board will be asked to evidence.

In healthcare, governance often runs through a clinical safety authority sitting outside the programme. It can halt a release on safety grounds without reference to the budget, which is the cleanest separation of decision rights in common practice.

Related terms

• Governance risk compliance: the standing company wide version of the same decision machinery.
• Enterprise risk management: the scoring that tells a programme board which risks to escalate and which to accept.
• Agile portfolio management: funding decisions taken on a review cycle rather than through one business case.
• Information governance: decision rights over data and records rather than over a programme of work.
• Program outsourcing: handing programme delivery to a partner, which moves the work but never the accountability.

FAQ

What is the difference between program governance and a project management office?

Governance is the authority to approve, change or stop. A project management office is the standing function that runs approved work and reports honestly on its progress. Confuse the two and you get an office with no authority and a board with no information.

Who should chair a programme board?

The executive who owns the business case and can release or withhold the money. A chair without budget authority turns the board into a status meeting — a very well attended one.

How often should a programme board meet?

Often enough that decisions do not queue: monthly for most programmes, fortnightly during a high risk phase. The meeting frequency matters far less than the written thresholds that govern the gaps between meetings.

What is a stage gate?

A scheduled decision point where a programme must show evidence before it is allowed to continue. The gate only has teeth if stopping is a genuine option on the day. Gates with a default pass are a reporting rhythm wearing a governance name.

Can program governance be outsourced?

Administration can be: secretariat, reporting packs, independent assurance reviews. The decision rights themselves cannot, because accountability does not transfer along with the work.

Shortlist vetted delivery partners in the Outsource Accelerator directory before you put a programme out to market.