Chapter 19

Auditing Someone Else’s Project

In This Chapter

Checking your focus on what the audit task is all about

Checking key documents

Checking plans to be sure that they’re consistent

Making sure that the balance of control is correct

Project Audit isn’t important; it’s vital. It’s strange, isn’t it, that while just about every organisation wants to be sure that its projects are running well, project audit is still undervalued? Good audit should be really positive and productive, and the case for it is a no-brainer. The good news for you if you are auditing someone else’s project is that you can make a genuine and valuable contribution. Although you’re independent of the project, you should approach the audit task with a ‘member of the team’ mindset, not as someone whose role is to put the project under pressure, cause irritation or make life even harder for the Project Manager than it already is.

Your objective as an auditor is to make sure that the project is set up properly at the start and then is running properly as it continues. When you stop to think about it, that’s almost certainly what everyone else in the project wants too. Unless the project team is a bit weird (probably unlikely even in your organisation) then everyone will want it to succeed. If you spot an error or omission then it can be corrected and that will help the project run smoothly towards successful delivery.

Audit Focus Checklist

Predictably this chapter is quite detailed, so before you get into the nitty-gritty it may help you to pull back first and make sure you have a clear view of what your task is all about when auditing a project.

• Completeness: To check that documents such as the Project Charter are complete and that essential parts haven’t been forgotten.
• Accuracy: Where there are calculations, such as for benefit levels, making sure that the arithmetic is correct; a simple but important check.
• Appropriate control: That the level of planning and control is appropriate to the nature of the project. Check for excessive control as well as insufficient control. For example, that there isn’t a huge Project Steering Group (PSG) with 27 members to oversee the repainting of the stationery cupboard.

Okay, I admit that the 27 member PSG for a stationery cupboard is an exaggeration in a weak attempt at humour. However I once saw a project that wasn’t too important but which had two people doing all of the project work (including the project management) and a ‘Steering Committee’ of seven people overseeing it. Another had 21 on a Project Board (equivalent to a PSG) to oversee a team of about eight staff.

• Realism: Checking that the Business Case is realistic and that plans are achievable rather than just wishful thinking.
• Compliance: Checks to ensure that the project will comply with any necessary standards including internal organisational ones such as for project risk management as well as the more obvious external ones such as planning regulations.
• Deeds not words: During the project, checks to make sure that controls are actually being put into effect and then that they’re working.
• Your task: Focus too on what you are actually being asked to do for audit on this specific project so you don’t end up doing the normal quick health-check when actually you were required to do detailed audit on this business critical project.

Outline Charter Audit Checklist

There’s some initial work in Kick Off to produce an Idea and then a Recommendation. At that point the perspective is a business one. When the Outline Charter – or just ‘Outline’ – is produced later on in Kick Off, things get rather more serious and project experience is called on as well as business experience. Because the Outline lays the foundation for the project, this is the first point where you are likely to be called in as a Project Auditor to make sure that everything’s okay.

The Outline is important because it lays the foundations for the project, as explained in the last paragraph, but also because it’s the last major point where it’s easy to stop. Although the project could be halted in the Planning Stage, considerably more resource will have been expended by then, so your check here is more than a little important.

Predictably there are quite a few things for you to watch out for and check on, but a key one – so worth singling out here – is that the project really is justified. If it’s justified by benefits, look particularly carefully at the projections to ensure that they are realistic and that the project hasn’t been ‘talked up’. Having made that point, here’s the checklist with the full detail:

• Clear boundary: Ensure that the boundary of the project has been spelled out clearly. Check that the ‘negative scope’ (what the project won’t include) information is clear so that people will be in no doubt as to what the project won’t cover as well as what it will if there could be any misunderstanding.
• Sensible scope: Check that the scope is sensible and makes for a good project. Look for anything that doesn’t seem to align with the rest, then check for any gaps where it appears that an area has been left out but it’s either essential or desirable.
• Clear deliverable: Make sure that the Outline defines clearly what the project will deliver, whether that is a product, some service or other outcome.
• Time estimate: Using your knowledge of the organisation and the capability of project staff, is the project timescale realistic? Pay particular attention to any lead times that may have been overlooked, such as getting approval for something as part of the project. Getting legal approval, even internally from a large organisation’s legal department, can be a long process and it’s often underestimated. However the time needed to get approval to things like technical specifications is often underestimated too.

Don’t forget that your checks here are on the Outline Project Charter, not the full Charter. The Outline is much more detailed than the Recommendation that preceded it, but it’s still a ‘sketch’ document. Don’t push a project into going into too much detail too early by making audit points saying that the information is insufficient when in fact you have the full Charter in mind, not the Outline.

• Cost estimate: Is the cost estimate realistic based on your knowledge and on records of any previous projects which were similar in whole or in part?
• Resource: Check that the resource estimates are realistic and that the people to be involved (or it may just be skills such as ‘power engineers’ at this point) are actually available.
• Justification: Is the project justification in the Business Case accurate and sound? Have a look at Chapter 5, Checking the Justification and Benefits, for more on project justification and note that a project may be justified on something other than benefits.
• Benefits: Where the Business Case does list benefits, are the levels realistic and are the benefits correctly categorised? Again see Chapter 5 for more on the Business Case and benefits.
• Roles: Check to ensure that proposals have been made for filling all of the project roles and that the people suggested are both suitable and sufficiently available.
• Business impact: Ensure that the impact on the business and on stakeholders outside the immediate area of the project has been evaluated and considered. It’s easy to underestimate the business impact both in extent and in degree.
• Ancillary work: If significant work will be needed elsewhere in the organisation to accommodate what the project is delivering, has this been thought through? Then have sufficient checks been made that the necessary work can actually be resourced and done, and in good time?

Planning Audit Checklist

Towards the end of Kick Off the Stage Plan for the first project stage, the Planning Stage, is created by the Project Manager – he’s creating a plan for the planning. Given that inadequate planning is a known cause of project failure, it’s a key area for you to check on in project audit. Use this checklist to help evaluate if the plan for the planning is up to scratch.

In the Planning Stage, three key documents will be prepared. The three are the full Project Charter, the Project Management Plan (PMP) and the Stage Plan for the first Delivery Stage. The Stage Plan for the Planning Stage covers the work needed to produce all three.

• Balance: Does the plan reflect the control needed on the project? Under-planning is likely to lead to problems of course, while over-planning just wastes resource.
• Completeness: Check that the Stage Plan covers the production of all of the required elements of the Charter and PMP.
• Realism: Check that the Stage Plan is realistic and achievable overall. It’s unlikely that a multi-million dollar, split site, business critical project can be planned by one person in a planning stage that’s just two days long, even if they stay up all night.
• Risk: A spotlight to check specifically that enough time has been allocated for risk analysis and planning. That’s particularly important, obviously enough, if the project is a high-risk one.
• Quality: Another spotlight as the work involved in specifying and planning quality control is often underestimated.
• Business Case: A third spotlight on specifics, this time to check that sufficient time is included in the Stage Plan to produce a sound Business Case. In turn that will depend on the project justification and the amount of work already done for the Outline.
• Planning resource: Make sure that the staff resource needed to create the plans is included in the Stage Plan and that the people involved are actually available. That may include subject specialists such as engineers and also Team Leaders.
• Planning time: Check that the Planning Stage is long enough to build effective plans. For example, ensure that sufficient time has been allowed for resource levelling and calculating the budget. Check that the Project Manager hasn’t reduced the planning time in response to ill-judged pressure from senior managers to ‘get on with the real work’ in the Delivery Stages.
• PSG involvement: Check that the resourcing for the plan includes PSG members. That may be in a Planning Workshop or to work on individual elements of the plan. The Project Manager can’t create the Charter and PMP in a vacuum.

Project Charter Audit Checklist

Once the three key documents of Project Charter, PMP and the plan for the first Delivery Stage have been produced in the Planning Stage, you may well be asked to check the project over. The next checklist is for the first of the documents, the Project Charter. The Project Charter is developed from the Outline Charter developed during Kick Off. You should look out for the same things as in the Outline Charter Audit Checklist earlier in the chapter, but now there are a few additional things to look for and some areas where you need to dig a bit deeper – just so you feel that you’re still needed.

• Basic checks: Have a look at the checklist for the Outline Charter earlier in the chapter and make sure that in the full Charter those things haven’t been compromised.
• Scope: Check that the scope statement is crystal clear on what is in the project and what isn’t. Then check that the scope aligns with the project level Work Flow Diagram.
• Requirements: Check that any requirements for the project are listed together with the source (such as a legal requirement) and that they’ve been covered in the scope and documents such as the Quality Plan.
• Business Case: The full Business Case in the Charter is an essential item for the PSG. Ensure that it’s complete, well considered and that the calculations behind the figures (notably cost, time, resource and benefit levels) are correct. Pay careful attention to any non-quantifiable benefits to check that they haven’t been exaggerated.
• Organisation: Check that the organisation chart is correct and shows the people actually taking part in the project. Some appointments may have changed since the suggestions in the Outline.
• Constraints: Look at the constraints to make sure that they really are constraints. Challenge any that are not, for example an arbitrary delivery date imposed by a Senior Manager who thinks every project should be put under pressure to meet a chosen date. Unnecessary constraints can damage a good project, for example when quality ends up being cut to meet a fixed deadline, when really another week on the project wouldn’t have mattered that much.
• Acceptance arrangements: Make sure that the acceptance arrangements for the handover of project products are clear and as simple as possible. Check also to ensure that the people responsible for acceptance have been named, or at least that their position, such as ‘Production Manager’, has been stated.

PMP Audit Checklist

The Project Management Plan (PMP) is made up of a lot of component plans and you can find checklists for them in this chapter. This first short checklist relates to the PMP as a whole before you go on to look at the specific plans.

• Complete: Check that all the component elements needed for the project are included in the PMP. Not every project needs all of them and in particular the project might not need a separate Procurement Plan.
• Clear: Check that the component plans are clearly written. A lot of people in the project, such as Team Leaders and PSG members, will need to refer to the plans as well as the Project Manager. The plans must therefore be clear and understandable to all, not written in some abbreviated form that only the Project Manager can understand.
• Concise: To accompany the last point that plans should be clear and properly explained is the counterbalance that they should then be concise. Unnecessary detail and complexity in the plans results in too much resource being used to create them (although that’s water under the bridge now), but importantly those plans must be maintained through the project, taking up more unnecessary resource.
• PSG involvement: Although the PMP is primarily the Project Manager’s document, the PSG must check that the controls are sufficient and must input some of the information such as the availability of staff and finance. Ensure that PSG members have been involved in the production of the PMP and that they agree with it from a project governance perspective.

Project Plan Audit Checklist

As a Project Auditor you should be familiar with product, activity, resource and financial planning. From your experience you’ll know the sort of things that planners can miss, but here are a few reminders of the main areas to help you cover all the bases.

• Accuracy: Check the plans for technical accuracy, such as that products have been correctly modelled. Inaccuracies can lead to errors in control.
• Completeness: Check that plans are complete including, for example, management actions not just the product construction activity.
• Consistency: Ensure that the plans are consistent with each other. For example, for every team product on the product plans, are there corresponding activities on the activity plans to build that product?
• Quality checks and rework: Make sure that work to test products, including staff resource, is included and also time and resource for some re-work. Not every product will pass test first time.
• Resource: Check that the people shown as resource on the plans are actually available when the plan shows that they are needed. Check too that non-working days (such as public holidays and booked annual holiday for particular staff members) are accounted for on the plans.
• Realistic: Take a critical look at the plans to ensure that they are realistic and achievable. Check that staff members aren’t allocated 100 per cent unless the activity durations allow for some non-working time.

Nobody can work 100 per cent of the time so it’s unrealistic for Project Managers to have that in their plans. People chat when first arriving in the office, read company emails, take holidays and – shock, horror – even go sick sometimes. For more on availability you might like to look at the classic The Mythical Man-month by Frederick P. Brooks, Jr. published by Addison Wesley Longman, but you’ll find productivity stuff on the internet too.

• Timing: Is the timing sensible on the activity plans including, where appropriate, lag times? You can’t do induction training for newly recruited project staff the day after the contracts have been sent out – people who already have a job need to work a period of notice with their current employers. It’s not uncommon for Project Managers who are focused on project activity to miss these important lags.
• Contingency: Check that there is sufficient contingency in the plans. It should really be visible and clearly labelled ‘contingency’ rather than hidden in inflated estimates.

Risk Plan Audit Checklist

The controls in the Risk Plan must be clear but also appropriate for the project. A common problem in projects is that insufficient attention is paid to risk management, and projects get into unnecessary difficulties or even fail as a direct result. However, it’s important that Project Managers and PMP members don’t make the opposite error with excessive risk management and control that simply isn’t justified for the project. Unnecessary control just drives up project overheads both in terms of cost and wasted time.

• Standards: Ensure that the project risk approach complies with organisational standards, but also that exemption from such standards has been obtained where they are inappropriate for the project.
• Procedures: Check that the risk procedures are clearly set down, such as how a team member should report a newly identified risk.
• Reporting: Check that risk reporting requirements are clear, such as including information on the status of key risks in the regular progress reports that the Project Manager gives to the PSG. This aspect may be covered in part in the Communications Plan.
• Escalation: Ensure that the escalation trigger is clear when a risk changes to a degree that the Project Manager must inform the PSG immediately.
• Review: Check that the risk review strategy is clear, such as that each risk will be reviewed every four weeks on a rolling program with 25 per cent done each week.
• Recording: Ensure that the contents of the Risk Log have been specified and are appropriate (avoiding excessive detail for a low-risk project but including sufficient detail where a project is higher risk).
• Interfaces: Are the interfaces with organisational risk management clear? For example, referring a risk identified in the project to the organisational risk management system if it has wider implications.

Quality Plan Audit Checklist

Quality isn’t a game to just ‘go through the motions’ and make things look good and your audit should check for such superficiality. The Quality Plan should show how the required level of quality will be achieved and how genuine checks will be performed to ensure that. Thorough quality management can be simple though, so in your audit you should be looking for effectiveness not complexity. Indeed simple controls are often the best because everyone in the project can understand them.

• Required quality: Check that the required quality level has been clearly stated in terms that those working on the project will understand.
• Level: Is the specified level of quality appropriate? Specifying excessive quality is wasteful while specifying too low a level will lead to problems at best and is downright dangerous at worst.
• Standards: Check that all relevant standards have been listed in the plan. That includes internal organisational standards as well as external ones such as safety regulations.
• Records: How will tests and other quality actions be recorded so that it’s clear that they’ve been done and not forgotten?
• Regular checks: Check that the plan includes how regular checks will be done to ensure that the required quality is actually being delivered. That could simply be the Project Manager and Team Managers examining the Quality Checklist from time to time but a high quality project will need more.
• PSG checks: Ensure that project controls include the PSG checking on the delivery of quality at Stage Gates. This can be done simply by including it on the standard agenda for the Stage Gate meeting.
• Double checks: If the project will include very high quality products, check that that the quality procedures are sufficient. For example, a signature that a test has been done may not be enough (people have been known to sign things anyway) so routine second testing of key products may be sensible.

Project Controls Audit Checklist

Checking that the project controls are appropriate is a tricky business and one for which it is hard to provide a checklist; so much will depend on the characteristics of the project. However, here are a few things to look out for.

• Balance: The balance this time is to check if the degree of control is right for the nature of the project. Look out for excessive control that will merely drive up overheads for no gain, and at the other extreme for insufficient control that will put the project in danger. Part of your evaluation will be based on the experience of the Project Manager and the PMP members.
• Project Manager authority: Check that the Project Manager has ‘room to breathe’ to get on and do his job. Watch out for excessive controls demanded by a nervous PSG that is trying to micro-manage.
• Clear authority: Check that the Project Manager’s authority is clear so he knows when he can make a decision and when something must be referred to the PSG.
• Stage checks: Make sure that effective controls are in place to check on the progress of a stage and get early warning of any problems. That will be the Project Manager’s own checks, but also progress reviews by the PSG.

Stage Audit Checklist

You may be asked to do intermittent – possibly random – checks while the Delivery Stages are running. For example, you may be asked to do two random checks during the life of the six-stage project. It’s unusual to require multiple checks in every stage in the project. The focus of your stage check will to be to make sure that the controls specified in the PMP are actually being operated and that the information is correct. For example, where the Project Manager is reporting to the PSG that the stage is on target for delivery on time and to budget, do the calculations and evidence support that?

Clearly the Project Manager will be very busy and focused on the project during Delivery Stages. You need to come alongside with the minimum impact while at the same time getting your job done. If you do it right, the Project Manager will welcome you as ‘another pair of eyes’ to check that everything is okay.

• PMP controls: Unless you’re very familiar with the PMP for the project, check it before you start your audit to be quite sure that you know what controls are supposed to be operating and when.
• Plans: Check that the Stage Plan is up-to-date with actuals (time actually taken for work and money actually spent) being entered regularly.
• Progress reports: Check at least the last Stage Progress Report given to the PSG by the Project Manager. Check the facts reported and find the evidence behind them. Look, for example, to see when products have been completed and look at the Project Manager’s records and calculations.
• Team data: The Project Manager’s progress reports will be based partly on data provided by the teams (actuals). Examine some team member timesheets to see if the information looks realistic.

I once worked in a large company where a very senior and authoritarian manager reprimanded the junior managers in his section for having their staff working extra hours. He said that if the staff couldn’t do the work in the standard week that showed very poor management control at the lower level. His junior managers took the hint, and to protect their own careers instructed their staff to enter work totalling exactly 37.5 hours a week on each timesheet (the standard working hours). Unfortunately this data was also used for project calculations and to help develop bids for future work. The under-reporting of work hours had very severe consequences.

• Spending: Check that spending is properly recorded and that reports of the financial position of both the stage and full project are correct. Check that projections for future spending are realistic and correctly calculated.
• Quality: Check that the required quality is being delivered. Have the planned tests all be done on products completed to date, or have some been ‘forgotten’, and were they done by the right people? Has any necessary remedial work been carried out?
• Standards: Following on from the previous point, where products must comply with a standard (external such as electrical safety or internal organisational standards) is there evidence that the right checks were done to confirm compliance?
• Risk: Check that risks have been reviewed at the frequency set down in the Risk Plan. Have any new risks been reported and if so have they been handled correctly, not overlooked?
• Business Case: If the Business Case should be being checked by the Project Manager at intervals during stages, not just at stage end, look to see if the checks have been done. Such checks will probably involve benefit projections and a final cost estimate but it could be more – the PMP controls will say.
• Project Memos: Where Project Memos have been sent in, does the Project Log show that they have been considered and any necessary action carried out? Where action is required, has it been carried out or have things got forgotten?
• Referral: Check that the Project Manager is working within the limits of his delegated authority. If something should have been referred to the PSG (such as a scope change) check that it was.

Stage Gate Audit Checklist

There are two areas to focus on if you audit the project as it approaches a Stage Gate. The first is to check that the reported information is correct and that everything is up-to-date for the stage just finishing. The second is to look at the plan for the next stage and any changes to the project controls that will be used in that stage. As always the exact checks you carry out may vary according to the nature of the project and any organisational standards, but here’s a list to help you think across the important areas.

• Closing data: Check the figures on the Stage Completion Report to make sure that they’re accurate. That will include cost and team hours, but there may be figures on things like productivity levels as well.
• Product completion: Check that all products that were supposed to have been delivered in the stage have been delivered.
• Quality: Check to ensure that all of the planned tests and checks were carried out correctly. Also ensure that if a product needed correction then it was tested again after that work to be sure that it was then okay and met its quality criteria.
• Business Case: Ensure that any necessary update of the Business Case has been done and that the Business Case correctly represents the project as it is now, not how it was at the start. This document is vital for the PSG to assess if the project is still viable.
• Benefits: If any quantifiable benefits came on stream during the stage and were due to be measured and reported, check that they have been.
• Risk: Check that the risk assessment has been updated so that the PSG will have accurate information on the level of risk as it is now and on the status of individual key risks that will significantly affect the rest of the project.
• Stage Plan: Check the new plan for the next stage and ensure that it is accurate, realistic and achievable. Make sure that the Project Plan has been updated if necessary to keep the plans consistent.
• Resource: Following on from the last point, specifically check that the resource shown on the new Stage Plan is available. You might do this by looking at confirmation received by the Project Manager or you might check with the Project Supplier, Project User and the staff themselves.
• Project Charter and PMP: Check that the Charter and PMP have been reviewed and updated where necessary. For example, there may have been a change of some staff at the end of the stage which should now be shown on the organisation chart.
• Controls: Ask questions to assess if the control in the previous stage was adequate. If not, make sure that adjustments to the controls have been talked through between the Project Manager and PSG members and the PMP updated accordingly.

Project Closure Audit Checklist

Your audit work at closure will be similar to the end of a stage, except that you are now checking data covering the whole project and there is no check of plans for the next stage – because there isn’t a next stage. You want to be sure that the figures are accurate, such as the final cost and number of staff hours, but also that the information in the Project Closure Report is complete.

• Closing data: Check the figures in the Project Completion Report to make sure that they’re accurate. Watch out particularly to ensure that all costs are included. There may be bills that have still to be paid by the Finance Department and so some spending may be not yet show up against the project cost code on a computer report from the finance system.
• Product completion: Check that all products across the whole project have been delivered. That should be quick to do if you have been doing checks at the end of each stage.
• Quality: Check that any necessary certifications have been obtained, such as for electrical safety.
• Handover: Ensure that all necessary handovers have been done, and that any documentation related to them is complete.
• Benefits: If any quantifiable benefits that came on stream before and at the end of the project were due to be measured and the levels reported in the Project Completion Report, make sure that they have been.

Not all benefits will be measurable at the end of the project. Even where a quantifiable benefit is measurable, someone may have decided to leave the measurement for a while until things are more stable, and the figure will be more reliable. Look in the Business Case to find when individual benefits should be measured and reported.