The Complete Project Management Office Handbook, Second Edition (ESI International Project Management Series)

The PMO can lead development and implementation of auditing activities prescribed for use within the project management environment. It can choose the extent to which it is actually involved in conducting audits and reviews, but it should be a participant in reviewing and deliberating results as a basis for ascertaining the overall health and effectiveness of project management within the relevant organization.

The prominent activities of the PMO's "project auditing" function model are depicted in Figure 15.1. Each activity is described in the following subsections.

Figure 15.1: "Project Auditing" Function Model

Set-Up Project Auditing Capability

The PMO can be instrumental in defining the proper types and levels of review and audit activities conducted within the project management environment. However, appropriate and timely planning is essential to achieving a viable auditing capability. The auditing capability needs a process and an organizational basis for maximum effectiveness.

The PMO can consider the activities in the following three subsections when establishing or refining a project audit capability.

Determine Project Auditing Needs

The frequency and nature of project audits and reviews is a matter of the relevant organization's need for oversight and assurance of project management capability and the alignment of support for business interests. To that end, the PMO will want to identify the needs for audits and reviews and then select the preferred ones for incorporation into the PMO's arsenal of management tools.

Across industries, professionals in project management will encounter the term "project audit." Unfortunately, across industries, and sometimes within organizations, there are different interpretations with regard to what a project audit is and what it accomplishes. This function model offers a "project management audit" as a primary examination tool for PMO consideration and then goes on to identify and define other types of audits and reviews applicable to the project management environment.

The PMO should examine the following subsections for audits and reviews that can or should be implemented within its project management environment.

Primary Project Management Audits

Primary project management audits represent a few essential audits that can be considered by the PMO and prescribed for use within the project management environment.

Project Management Audit. Despite being broad in scope, this audit provides a fairly comprehensive examination of project management performance. Although the project manager or project team can perform this audit, it is highly recommended that this audit be conducted by the PMO or some other third-party to accomplish an impartial and objective appraisal from an unbiased perspective. This is a formal audit that may take one or more qualified auditors a full day or more to complete, depending on project size, and with additional time needed for associated analysis of findings and report preparation.

This audit is accomplished through discussions and interviews with the project manager, technical leaders, and at least a sampling of project team members in conjunction with a hands-on review of pertinent project documents. It normally includes examination of:

• Project work plan and support plans created to guide the project management effort:

  • Completion of required planning documents (per project classification)

  • Adequate inclusion of prescribed plan content

  • Appropriate inclusion of preferred practices and industry standards

• Effectiveness of project work plan and support-plan implementation:

  • Accomplishment of project work efforts according to applicable plans

  • Demonstrated tracking of actual project results against work plan elements

  • Timely identification and response to variations in work plan elements

  • Use of approved change-management procedures for modifying plan content

• Oversight of project resource management and task performance:

  • Identification of assigned project resources and their contributing competencies

  • Management of resource task assignments and task completion status

  • Accessibility and use of the project work plan and applicable support plans by project resources

• Oversight of project vendor/contractor management and task performance:

  • Identification of roles and responsibilities of vendor/contractor project team

  • Management of vendor/contractor assignment and deliverable status

  • Accomplishment of vendor/contractor deliverable approval and acceptance

  • Performance of vendor/contractor contract administration activities

• Fulfillment of customer contractual obligations:

  • Accomplishment of adequate deliverable quality assurance activities

  • Achievement of timely presentation of deliverables and customer acceptance

  • Performance of customer contract administration activities

This general project audit is applicable to larger and longer-duration projects that are already underway beyond the initial planning stage. It is an audit that can be performed as often as quarterly until the project reaches the close out stage.

Project Performance Audit (Project Health Check). This audit represents a detailed examination of the financial and business aspects of the project. In particular, earned-value analysis or some other preferred method of financial examination is applied, business case elements are reviewed, and the project risk management plan and activities are evaluated. This is a formal audit that will generally take one or more fully qualified auditors three to five days to identify conditions, analyze findings, and prepare a fundamental project performance audit report, depending on the size of the project and the scope of the audit. Validity of the audit is significantly enhanced when conducted by the PMO or other external, third-party auditor.

This audit can be conducted independently or in conjunction with a project management audit to review and validate the financial and business conditions of the project, with emphasis on evaluating and confirming the ability of the project to achieve specified objectives. This audit normally includes examination of:

• The business case used to manage selection and continuation of the project:

  • Relevance of business purpose and alignment with business interests

  • Achievement of staffing aligned with the resource allocation plan

  • Confirmation of trends toward achieving cost-benefit analysis results

  • Achievement and acceptance of project deliverables

  • Identification of customer relationship status and pertinent issues

• Cost specified in the project work plan:

  • Review of cost tracking and reporting methods and accuracy

  • Identification and evaluation of cost performance (i.e., planned versus actual)

  • Identification and evaluation of cost variance

• Schedule specified in the project work plan:

  • Review of schedule tracking and reporting methods and accuracy

  • Identification and evaluation of schedule performance (i.e., planned versus actual)

  • Identification and evaluation of schedule variance

• Resource utilization specified in the project work plan:

  • Review of resource utilization tracking and reporting methods and accuracy

  • Identification and evaluation of resource utilization performance (i.e., planned versus actual)

  • Identification and evaluation of resource utilization variance

• The project risk management plan:

  • Achievement of project risk identification, analysis, and prioritization

  • Documented review and update of project risks at appropriate intervals

  • Specification of risk response strategies for high-priority risks

  • Inclusion of proactive risk response strategies in the project work breakdown structure (WBS)

  • Preparation of contingency plans and acquisition of funding for reactive risk response strategies

This project performance audit is applicable to virtually all projects of discernable value and duration that are already underway beyond the initial planning stage. It is an audit that can be performed as often as quarterly until the project reaches the close out stage. The PMO can also use this audit in conjunction with project portfolio management reviews.

Preproject (Planning Phase) Audit. This audit validates project readiness for implementation. It is usually performed by the project manager and project team, but it can also be accomplished by the PMO or other external auditing team or third-party auditor. This audit presumes that requisite project selection activities have been accomplished and normally includes examination of:

• Initial project management documents and activities:

  • Finalization of the project definition

  • Validation of the project budget and resource allocation plan

  • Preparation of the project charter (specification of project manager authority)

  • Authorization of project funding (if not in project charter)

  • Executive (sponsor) approval to proceed with project implementation

• Initial technical documents and activities:

  • Review of customer requirements documents

  • Review of technical specifications documents

  • Review of technical survey documents

  • Preparation of project quality management plan

  • Identification of technical plans needed for the project

  • Preparation of initial technical plans required by methodology or policy

• Initial project management planning documents and activities:

  • Preparation of the project work plan

  • Preparation of the project risk management plan

  • Preparation of the project communication plan

  • Identification of project management plans needed for the project

  • Preparation of initial project management plans required by methodology or policy

• Initial project team documents and activities:

  • Preparation of the project responsibility matrix and staffing plan

  • Appropriate participation in project kickoff and planning meetings

  • Specification of project team member reporting requirements

  • Determination of project team readiness to begin project execution

• Initial vendor and contractor documents and activities:

  • Coordination and acceptance of vendor/contractor technical approach

  • Specification of vendor/contractor reporting requirements

  • Execution of vendor/contractor contract or agreement

  • Determination of vendor and contractor readiness to begin project execution

• Initial customer documents and activities:

  • Acceptance of technical solution by customer

  • Specification of customer reporting requirements

  • Execution of customer contract or agreement

  • Confirmation of customer readiness to begin project execution

This preproject audit is applicable to virtually all projects of discernable value and duration. It is an audit that is performed as people and plans become ready for project execution. In a sense, it is a "gateway" audit that facilitates transition from the planning phase to the project execution phase. Here, the planning phase emphasizes development of initial project management and technical plans necessary to describe the project's game plan. Additional project plans can be prepared in conjunction with project execution.

Postproject (Close Out Phase) Audit. This audit confirms project readiness for closure. It is usually performed by the project manager and project team, but it can be accomplished by the PMO or other external auditing team or third-party auditor. This audit normally includes examination of:

• Customer acceptance of project deliverables:

  • Receipt of interim and final customer acceptance statements

  • Completion of customer's evaluation of project performance

  • Preparation and submittal of invoice(s) to customer

  • Receipt of customer invoice payment(s)

• Project lessons learned:

  • Review of project financial and business performance

  • Review of project management plan content and effectiveness

  • Review of technical plan content and effectiveness

  • Review of project team performance

  • Review of customer feedback and evaluations

• Vendor/contractor close out activities:

  • Evaluation of vendor/contractor performance

  • Receipt of vendor/contractor invoices(s)

  • Payment of vendor/contractor invoice(s)

This postproject audit is applicable to virtually all projects of discernable value and duration. It is an audit that is performed when all project activities have been completed, deliverables have been accepted, and the project is ready for closure. This audit is the "gateway" audit that facilitates and, to a large extent, indicates project closure.

Review of Project Management Methodology. This audit examines the use and validates the content effectiveness of the established project management methodology. The PMO or a qualified external third-party auditor normally accomplishes this audit. It is a review that transcends individual projects and project managers to gain a perspective of the application of project management processes and techniques across all projects within the relevant organization. This audit normally includes examination of:

• General content of project management methodology:

  • Contains adequate descriptions of process (what to do) and practice (how to do it) for project management phases, activities, and tasks

  • Designates the roles and responsibilities of project team members and other stakeholders for participation in the accomplishment and oversight of project management activities and tasks

  • Provides adequate tools to facilitate the accomplishment of methodology process elements, e.g., automated tools or paper-based forms, checklists, templates, etc.

• Process content of project management methodology:

  • Presents a discernable process relationship and flow that advances the project through phases of initiation, planning, implementation/execution, and close out

  • Specifies all essential project management activities and tasks within each phase (per project management standards and practices used)

  • Incorporates essential technical planning and performance activities in each phase (per technical standards and practices used)

• Methodology utilization by project managers and project teams:

  • Identifies and reviews project management methodology phase, activity, and task use on a representative sample of projects in a specified time period

  • Determines causes for nonuse of selected methodology elements

  • Examines user feedback regarding methodology use

  • Identifies project management benefits or liabilities that can be associated with the use of project management methodology

  • Identifies business benefits or liabilities that can be associated with the use of project management methodology

This review of project management methodology can be accomplished annually to ascertain its completeness, effectiveness, and use.

Additional Project Management Audits

The category for "additional project management audits" includes a wide array of audits that can be considered by the PMO to achieve more-detailed examination of project performance elements or to ascertain conditions within the project environment.

The PMO can construct and perform audits to meet a variety of needs. The following list presents a few suggestions for additional project management audits that may be of value within the relevant organization:

• Customer satisfaction audit: An examination of the customer business relationship that identifies how well the customer perceives the project to be progressing toward the achievement of desired objectives.

• Project recovery audit: An audit similar to the combined content of the project management audit and the project performance audit, but with focus on the indicators of unsatisfactory project performance.

• Project support plan review: A review of the guidance prescribed by any of the individual project support plans. The PMO or a third-party auditor usually conducts this audit to provide an unbiased perspective on plan content, comprehensiveness, and usability.

• Project resource utilization audit: An examination of fulfillment of resource allocations and the timely assignment of resources for the accomplishment of specific tasks. This audit does not examine resource performance. The PMO or a third-party auditor usually conducts this audit to provide an unbiased perspective on issues and activities surrounding resource support by resource managers and at the executive level and includes examination of the effectiveness of project managers in assigning resources.

• Project team performance audit: A review of project work assignments and their alignment with individual technical and professional competencies of project team resources. The PMO or a third-party auditor usually conducts this audit to provide an unbiased perspective on individual capability issues, appropriateness of individual assignments, and the effectiveness of project manager and technical leader supervision.

• Vendor/contractor audits: An audit or review using any of the previously described project or project management audits, but one that is conducted within the vendor or contractor project management environment. This type of audit is normally authorized and conducted in one of two ways. First, the vendor/contractor can request assistance from the PMO in conducting an examination of its project management position and contribution to the overall project, and sometimes the PMO will encourage this. Second, the provisions of the applicable vendor/contractor service contract or agreement allow the PMO to independently initiate and conduct project management audits within the vendor or contractor project management environment.

These and other unique audits can be prescribed and performed when project performance conditions indicate the need for such examinations in the project management environment. The PMO should maintain the documented process of any new audit for future use and refinement.

Technical Audits

Technical audits are an inherent part of project management responsibilities. However, technical audits are distinctly aligned with the nature of the product or service delivered to the customer and with the particular technical skills and competencies found in the project management environment. Individual PMOs will need to define technical audits that are appropriate to and associated with the business operations of the relevant organization.

The following list presents a few generic types of technical audits that are applicable across different project management environments for PMO consideration:

• Technical approach review: A thorough review of the technical solution prepared to produce required project deliverables and to achieve overall project objectives within the specified scope of work. It is normally accomplished early in the project planning effort, and sometimes in conjunction with the preproject audit.

• Quality assurance audit: An examination of the project quality assurance plan; associated test and acceptance plans; and quality control procedures, scheduled activities, and accomplishments. This type of audit is often aligned with responsibilities of quality management business units within the relevant organization. A general review of the project quality assurance plan also may be performed during the preproject audit.

• Project gateway review: One of a series of reviews conducted at technical transition points or phases in the project, e.g., design, build, produce, test, etc. The gateway review examines the readiness to proceed with the next major technical activity, including:

  • Verification that all requisite technical activities have been properly accomplished

  • Determination that technical leaders and project team resources needed to conduct the technical work prescribed in the next technical phase are available and ready to begin the assignment

  • Confirmation that the executive (sponsor) and customer agree to proceed to the next technical activity

  • Receipt of required funding for the next technical activity

• Structured walk-throughs: A technical review, usually conducted by a group of technical experts, including project team members, customer representatives, and external technical advisors, to validate a technical process or procedure, a technical design or approach, or a technical performance outcome normally associated with a project deliverable.

• Technical reviews: An examination of technical content, usually conducted by project team members, to adjudge satisfactory completion of technical tasks that contribute to preparation of project deliverables. The PMO, in collaboration with technical leaders in the relevant organization, can construct procedures for required technical reviews within the project management environment.

The PMO should prescribe routine technical audits for inclusion in the project work plan.

Identify Project Auditing Resources

The PMO may have responsibility for project auditing in the relevant organization, but it will likely not have the staff depth or broad skills to conduct all required audits within the project management environment. To that end, it will have to evaluate project auditing requirements and designate preferred auditors and auditing teams.

An inherent issue in identifying project auditing resources is the need to qualify auditors. Audit training and experience are prominent factors in qualifying auditors. As well, requisite technical or project management competency is a primary factor for consideration of auditor qualification by the PMO. Qualified auditors can then use the PMO's prescribed approach to conduct audits.

In addition to the PMO, there are four types of resources that can be used to conduct audits in the project management environment. These are described in the following subsections.

Project Managers and Project Team Members

Project managers have responsibility for continuous monitoring and management of project status and progress. They inherently conduct informal audits as part of their ongoing practice of project management. They can similarly be given responsibility for performing particular project audits specified by the PMO as project conditions warrant or as project audit points are encountered. The key here is that they will distinctly use auditing guidance and processes prescribed by the PMO to make the performance of designated audits consistent across all projects.

Individuals serving as senior project managers have demonstrated their understanding of project management concepts and principles; they are more or less well versed in the nuances of project management within the relevant organization; and they presumably have the experience required to use and comprehend primary project condition indicators. This qualifies the more senior project managers to conduct audits on projects other than their own. The key here is for these resources to demonstrate an ability to achieve an impartial, business-oriented review of people, performance, and practices according to the procedures of the particular audit to which they are assigned.

As well, project team members who demonstrate technical or project management competency also can be used to conduct formal and informal project audits. They can assist the project manager in performing audits on their current project. Since they usually bring particular technical expertise, they can even lead certain technical audits and reviews. In some cases, individual expertise may warrant their assignment to auditing teams that are convened to examine projects other than their own within the project management environment.

To the extent that the PMO relies on project managers and project team members to conduct project management and technical audits, consideration for training them in effective and efficient auditing practices is warranted. Particular consideration should be given to training of individuals designated as leaders of primary audits within the relevant organization.

Internal Auditors

The PMO can canvass the resources available within the relevant organization to identify and qualify individuals from business units who can participate as auditors in the project management environment. In some cases, organizational policies and procedures, or the inherent responsibilities of individuals in certain business positions, will designate auditor status.

The following is a sample listing of a few roles in the relevant organization that can be considered for participation as technical and project management auditors:

• Senior managers, in any position (ideally ones that interface with project management)

• Quality assurance managers

• Quality control managers

• Finance managers and specialists

• Business analysts

• Senior engineers and scientists

• Senior technical specialists

Auditing team assignments for these internal resources should have some alignment between their primary specialty or professional credentials and the type of audit being conducted and their responsibilities for that audit. One important criterion in qualifying internal resources is that there must be at least one influential individual on the auditing team who can demonstrate advanced qualification in the application of concepts and content of modern project management practices.

Again, if the same internal resources are assigned to auditing duties on a recurring basis, some training in auditing practices, as well as training in project management practices and principles, is recommended for consideration by the PMO.

External Collaborative Auditors

The PMO can preclude an internal search to identify and qualify auditor candidates through use of external collaborating resources, such as project management auditing consultants. This approach is particularly cost effective when the frequency or type of primary audits conducted within the project management environment does not warrant an effort to fully qualify and train internal personnel in project management auditing practices and procedures. However, it can also be beneficial in organizations that desire to take advantage of third-party expertise and impartiality in conducting audits in the project management environment.

In taking this approach, the PMO will have to manage external auditor qualification and selection. This can be accomplished by following a few recommended steps:

• Identify the field of external project management auditor candidates: Prepare a list of auditing consultant candidates by examining project management capabilities and credentials; contrast candidate offerings against the anticipated range of auditing needs in the project management environment; and identify other areas of project management expertise the consultant has brought or can bring to the relevant organization.

• Discuss and evaluate the auditing process and approach of each candidate: Meet with auditing consultant candidates to determine the fit and effectiveness of each candidate's project management auditing process and identify the particular benefits to be achieved by their selection. Distinguish those consultants who offer only general business and management auditing capability from those who demonstrate complete comprehension of modern project management principles and practices as an inherent part of the auditing process.

• Select and assign the preferred external auditing resource: Make a decision regarding which of the auditing consultants will be introduced into the project management environment. If there is an identifiable need for the variety of project audits to be conducted by the selected consultant, arrangements should be made to schedule consultant participation. In particular, the PMO should note that there might be value represented by reduced service costs when multiple project management auditing assignments for the auditing consultant can be identified within a specified period.

These steps for selecting an auditing consultant are rudimentary, but fulfilling them can be a time-consuming effort for the PMO. The PMO should anticipate project auditing needs and — with consideration for the time involved in identifying and introducing external resources into the relevant organization — conduct the necessary internal coordination so that it can evaluate the external auditing consultants, select an appropriate candidate, and assign the task in a timely manner.

External Regulatory Auditors

The second type of external resource the PMO might encounter is the regulatory auditor. This auditor, who may or may not have expertise in the full range of project management knowledge and practices, has a bona fide need and appropriate authorization to conduct an examination within the project management environment. Generally, such an auditor is introduced in association with government regulatory requirements or through a government customer's contract provisions. However, in some cases, the PMO may be obligated to accept an auditor into the project management environment as a result of contractual provisions in a non-governmental customer's contract or agreement. This auditing possibility makes it an essential PMO job to review and understand the contents and provisions of every customer contract or agreement.

The regulatory auditor should provide an agenda and identify the scope of the audit to be conducted. PMO assistance may be needed (a) to schedule and arrange for participation of project managers and team members in auditor fact-finding meetings, document reviews, and other presentations and (b) to facilitate the auditor's administrative activities within the relevant organization. Otherwise, there is normally no formal responsibility for the PMO or the relevant organization to perform the audit steps prescribed by the regulatory auditor's process.

The PMO is responsible for ensuring that relevant executives and senior managers are aware of any scheduled audit by an external regulatory auditor. Advance notification of upcoming external regulatory audits also should be conveyed to project managers and project team members.

Establish Project Audit Performance Points

The PMO can establish audit performance points to specify when or under what conditions an audit will be conducted within the project management environment. There are three types of audit performance points that will be identified: the routine project audit point, the triggered project audit point, and the discretionary project audit point.

Routine Project Audit Point

The routine project audit point is a designated point in the project management life cycle or in a technical process at which a specified type of project or technical audit or review is conducted. This type of audit is normally identified in the project WBS and work plan, and its performance is anticipated as a routine part of the project management effort. It may include virtually all of the primary project management audits defined earlier, as project duration permits, and many of the technical audits and reviews associated with the nature of the project deliverables. The PMO should define and incorporate the process for conducting any routine project audit points into the project management methodology and associated technical processes.

Triggered Project Audit Point

The triggered project audit point is an unscheduled audit or review conducted in response to a project performance indicator, or "trigger," that suggests a more detailed examination of some aspect of project or technical performance is warranted. While a triggered project audit point is not necessarily anticipated at any specific point in the project, it should not present any major surprises to the project manager or project team. In a sense, it is a normal response to a highlighted condition in project performance. In fact, triggered project audit points can be identified in appropriate project plans and include the particular conditions under which such audits will be pursued.

Discretionary Project Audit Point

The PMO also may seek and obtain the authority to conduct audits at its own discretion, where a project audit performance point is not specified. Presumably the PMO will apply superb judgment to guide decisions that initiate such unanticipated audits in the project management environment. Moreover, unannounced project audits should not always have a negative connotation. There may be circumstances under which the PMO, in collaboration with project managers, wants to examine project team performance and participation under project audit conditions. Likewise, the PMO may need to conduct a minor audit across all currently active projects as a matter of specific information collection and analysis. Finally, the PMO may want to test a newly formed audit team in their performance of an auditing process.

Conduct Project Auditing

The PMO will need to develop guidance for conducting audits within the project management environment. Audits and reviews conducted as routine project management activities are normally unobtrusive and shortlived events, and procedures for their conduct should be adequately described in the project management methodology or applicable technical process. Audits and reviews deemed more critical or comprehensive and conducted outside of routine procedures will likely warrant some additional time for planning and preparation, performance of audit activities and analysis of results, and compilation of findings in an audit report. This is particularly the case when internal or external third-party auditors are introduced into the project management environment.

The PMO can address these needs — incorporating aspects into project management methodology guidance and preparing general guidance for third-party participants — by reviewing three primary activities that can be accomplished to fulfill project auditing requirements.

Prepare for Project Audits and Reviews

The PMO should specify the key audit preparation activities to guide its efforts when leading project audits. Project managers and project team members responsible for conducting routine internal audits and reviews on projects can apply this same PMO guidance, as contained in the project management methodology. However, the PMO often can defer audit preparation activities when either internal or external third-party auditors are taking the lead role in conducting a more formal audit or review in the project management environment.

Nevertheless, the following three project audit and review preparation steps are listed for PMO consideration and further development for use within the relevant organization.

Identify and Convene Auditor/Auditing Team

The PMO should prequalify lead auditors, particularly for formal audits. To that end, project managers would be considered "prequalified" to conduct routine audits by virtue of their position of responsibility and their training and experience in the concepts and practices of modern project management. Similarly, internal auditors coming in from other business units are likely prequalified by virtue of their roles, e.g., quality management, finance, etc. Therefore, it is usually the external auditor that requires some level of prequalification by the PMO. However, the PMO will need to maintain a list of available auditors from all internal and external sources, their particular audit or review area specialties, and general requirements for arranging for their services and participation.

As audit requirements are identified, particularly triggered and unannounced audits, the PMO can use its list of prequalified project auditors to select, request, and assign them to the audit activity at hand. In the case of internal or external third-party auditor participation in recurring, routine audits across multiple projects, the PMO can schedule and arrange for their services in advance of the need. In some project management environments, the PMO may want to prepare and publish a project audit schedule that extends out several weeks or months.

Convening the auditor/audit team will normally begin with an initial on-site audit meeting that the PMO may want to attend for the purposes of introducing audit participants and to ensure the proper specification of objectives in planning auditing activities. The PMO can also facilitate arrangements for work space and individual meetings for external auditors. This PMO participation may be required less over time as the PMO becomes familiar with auditor/audit team performance.

Plan the Audit

An initial audit meeting is recommended to identify audit participants and to plan (or review plans) for conducting the type of audit prescribed. Normally, the project manager should be included in this initial planning session to gain insight to planned activities and requirements for personal and project team member participation.

The audit planning session will be used to accomplish the following:

• Specify the type of audit to be conducted

• Identify the lead auditor and audit team members

• Review auditor/audit team preparation activities

• Request timely receipt of project documentation for advance examination

• Determine schedule and review auditor/audit team on-site activities

• Identify audit responsibilities of the project manager and project team members

• Identify any pertinent issues or problems that might be encountered

• Determine schedule and review audit report preparation activities

Audit planning is needed to establish a common frame of reference for all audit participants. This activity usually can be accomplished in less than one-half day, and in extenuating circumstances it can be achieved by means of a telephone conference for most common types of audits.

Conduct Auditor/Audit Team Preparation

The auditor/audit team will need adequate time to prepare for on-site auditing activities. To that end, it is particularly important that project documents and other requested materials be provided in a timely manner. The PMO may be able to facilitate or otherwise monitor the transfer of project documents and materials required for auditor review in this preparation step.

The nature of the project and the type of audit to be conducted will determine the time needed for audit preparation activities. In some cases, it can take up to two or three weeks to prepare for an on-site audit. The time needed can usually be determined and specified at the initial audit planning session.

The auditor/audit team will perform a number of activities to prepare for the project audit:

• Specify the scope and purpose of the audit

• Review project documents and materials per the type of audit prescribed

• Identify project documents that do not exist or are not available for review

• Identify individual and group audit interview requirements

• Prepare or review existing audit checklists to guide investigation activities

• Prepare and distribute an agenda for audit meetings and activities

• Coordinate final plans with PMO and project manager

The PMO can rely on established practices of internal and external third-party auditors to provide the necessary detail for these preparation steps. It may want to develop more-comprehensive audit preparation procedures for audits conducted in association with project management audits conducted by the PMO.

Conduct Project Audit

The auditor/audit team, in collaboration with the PMO and the project manager, should begin its on-site audit activities in a meeting with affected participants, likely the project team members. However, the project executive (sponsor) and other relevant project stakeholders also can be invited to attend. To the extent possible, this meeting should review the planned auditing activities and procedures, and it should also serve to reduce any anxiety and concerns about the audit. Participants in this meeting need to recognize that the pending audit is a natural and routine business activity designed and applied to ensure business success.

The audit will then proceed with a detailed examination of the project or elements of the project. It will include some combination of the following audit activities, per the type of audit conducted:

• Interviews: Auditors will meet with individual project team members and other project stakeholders, normally of their choosing (to remove bias), to discuss processes, activities, and performance of the project effort as a means of obtaining insight into the prevalent project conditions or to evaluate specific project condition indicators.

• Observations: Auditors will view project team meetings, group interactions, and individual work performance to identify contributions and influences on the current project condition.

• Further document reviews: Auditors will examine project documents and materials not previously examined, including individual documents and notes used to construct technical solutions, accomplish assigned tasks, and prepare project status reports. Auditors also may meet with individuals to receive clarification of content for project documents and materials examined during the audit preparation period.

• Analysis: Auditors will meet independently at intervals, generally at the end of each audit day for multiple-day audits, and throughout the day for shorter audit periods. These meetings will enable them to share information, identify common threads of findings, and formulate concepts of project conditions. This analysis meeting also will be used to identify topics of interest and points of focus for next-day/next-period audit activities.

• Initial audit feedback: The auditor/audit team will meet with the PMO, the project manager, and any other relevant project stake-holders to provide initial feedback regarding findings identified during the audit period. It should be noted by the lead auditor that there may be some variance in the details presented in the audit report, but the essence of the project conditions identified should be adequately conveyed in the report.

The specific audit activities to be conducted will evolve during the audit. The auditor/audit team will begin using the audit agenda and activity schedule to guide their activities. They will use preliminary audit findings to finalize their approach.

Prepare Project Audit Report

The project auditor/audit team will normally depart from the project management environment to prepare an audit report of findings and recommendations. Note that some audits are routine and are not necessarily conducted in response to any particular indicator of poor project performance. That considered, the auditor/audit team may well be able to report only a few findings. Indeed, the auditor/audit team may deem that overall adequate-to-excellent project and project management conditions will be presented in the audit report.

The following elements are recommended for inclusion in a typical project audit report:

• Executive summary:

  • Overview of the audit type and purpose

  • General description of the project's condition

  • General identification of the cause(s) of the condition

  • Summary of recommendations (prescription for project continuation)

• Audit approach:

  • Overview of the activity steps performed by the auditor/audit team

  • Overview of audit methods used

  • Identification of auditor/audit team members

  • Identification of other audit participants

• Audit findings:

  • Specific statements of fact resulting from the audit examination, usually indicating an adverse situation or condition

  • The impact, influence, or contribution of each finding to project performance

  • Apparent or actual cause of the audit finding, usually representing: a flaw or gap in established processes or procedures; a departure from established policies, standards, or management guidance; an incomplete or ineffective activity; or inadequate or incompetent task performance

• Audit recommendations:

  • Recommended actions and activities to remove or reduce findings and their cause

  • Suggested points of leadership and responsibility for each recommendation

  • Statement declaring the likelihood of project success after considering recommendations

The PMO can develop and use variations of this audit report content structure.

Manage Project Auditing Results

The PMO should be a recipient of all project audit reports. This enables it to properly accomplish its ongoing oversight role within the project management environment. In some cases, the PMO may be the primary repository for project audit reports, i.e., the project management library (see the PMO "knowledge management" function in Chapter 4). Nevertheless, it does have responsibility to maintain an awareness of project performance and project management capability within the relevant organization. The three activities described in the following subsections can be considered to help the PMO achieve its oversight objectives.

Review Project Audit Results

The PMO should conduct its own review of project audit reports as a matter of maintaining its awareness of conditions within the project management environment. This review should be timely and can be achieved in conjunction with an oral presentation by the auditor/audit team.

The PMO's review of audit results has three particular objectives that extend beyond the general need for awareness of the project management environment. These are described in the following subsections.

Identification of Troubled Projects

The PMO should identify, in collaboration with any other reviewers, whether the indications of project performance warrant special attention, up to and including the initiation of a project recovery effort. Short of that indication, the PMO can examine audit results in the following areas:

• Findings that can be resolved by the current project manager

• Findings that cannot be resolved by the current project manager, perhaps as a result of larger organizational policy or process issues or as a function of the PMO

• Findings that warrant PMO or PMO-arranged support of project manager efforts

• Identification of recurring difficulties for a particular project manager

• Identification of difficulties encountered across several projects

The PMO's review of each audit report will allow it to (a) assess trends within the project management environment and (b) be proactive in formulating solutions that resolve major and recurring issues and problems that adversely affect project performance.

Examination of Audit Completeness

The PMO can use the audit report as a basis for evaluating auditor/audit team performance. It should examine the report to determine whether the audit was complete and comprehensive and to verify that it achieved the objectives and expectations established. Points of examination can include:

• Consistency of reported audit findings with known conditions

• Clarity of findings statements that represent the adequacy and depth of auditor examinations and analyses

• Apparent constraints or roadblocks encountered by the auditor/audit team that reduced its ability to delve into certain aspects of project performance

• Apparent unanticipated intrusion or interference by the auditor/audit team in the project management environment

• Consistency and completeness of audit recommendations with reported findings

The PMO will presumably have selected a qualified project management audit consultant to conduct the audit. This is the PMO's opportunity to build a professional relationship with the audit consultant and to bring the needs of the project management environment, as well as the business interests of the relevant organization, to light so that future auditing efforts will be more closely aligned with PMO needs and expectations. This consideration works well for both internal and external third-party auditors.

Formulation of Follow-On PMO Activities

The PMO can examine each audit report to determine whether there are any required follow-on PMO actions that are either directly associated with report recommendations or indirectly associated with rectification or resolution of audit findings. The PMO should consider the following possible action areas:

• Review impact of policy guidance

• Review content and utilization of project management methodology

• Review content and utilization of technical processes

• Consider acquisition or replacement of project management tools

• Review training of project manager and project team members

• Review performance of project manager

Other needed PMO actions can be developed and pursued as dictated by the particular results of the project audit.

Analyze Aggregate Program Results

One means by which the PMO can develop and maintain its awareness of overall project performance is through ongoing reviews of similar audit-type results. This requires examining the aggregate results of audits across all projects, including current, completed, and terminated projects. It provides another way for the PMO to identify and monitor trends and the effectiveness of remedies applied to correct deficiencies in project performance.

A simple example of a tool that can be used to monitor audit trends and remedies is a cross-tabulation worksheet. This worksheet can be constructed to enable the PMO to list audit findings by the type of audit conducted and the appearance of related findings across multiple projects. The worksheet can be expanded to include instances where a particular remedy was applied to projects, and an indication of improvement can be noted for all projects. In essence, this worksheet provides a current picture of the prevalent problems or deficiencies, the prescribed fixes, and the results of applied fixes. The PMO can update this worksheet as each new project audit report is received and reviewed.

Another benefit of performing aggregate analyses of audit results is that senior management and other project stakeholders can use them to review the overall project performance capability within the relevant organization. In particular, the PMO will be formulating and applying remedies to correct deficiencies, and an aggregate trend analysis will quantify the rate and nature of project performance improvement achieved, which can then be reviewed by senior management.

Aggregate analyses also will be beneficial for review by project managers, who can use them in planning meetings to incorporate remedies into the technical and project management approaches and activities. They can also apply and monitor remedies identified by other project audits during project execution or implementation phases, thus allowing them to recognize and perhaps avoid similar deficiencies or problems.

The PMO's examination of audit results from the larger perspective of all projects enables it to monitor and manage improvements in overall project performance.

Monitor Project Audit Follow-Up Activities

The PMO, as facilitator of the "project auditing" function in the relevant organization, should also ensure that the full value of auditing is achieved by monitoring the conduct of audit follow-up activities. This includes oversight of corrective actions applied at the project level as well as at the PMO's functional level.

This effort begins with a review of the audit recommendations to determine which will be accepted for immediate action, which will be placed on a long-term improvement activity list, and which will be deferred (but not discarded). This review should include collaboration with project managers, senior managers, and other project stakeholders, depending on the nature of the proposed remedy. In the course of review and collaboration — a single meeting or an ongoing series of communications — follow-up actions should be deliberated, decided, and assigned to responsible individuals.

The PMO can identify, track, and monitor several elements to ensure timely achievement of follow-up activities resulting from project audits:

• Activity statement: A simple statement of the effort, e.g., adjust status report frequency

• Activity description: A more detailed description of the effort that specifies the corrective actions to be taken, presents any required steps for effort or implementation, and indicates what objectives will be achieved when the corrective action is applied

• Activity completion date: The date by which the corrective action should be completed

• Activity interim review date(s): The date(s) when activity progress will be reported to the PMO

• Activity manager: The designation of the individual responsible for accomplishing the activity description

• Activity close out date: The date when the corrective actions have been completed

The PMO can use this information to monitor the progress of corrective action implementation and, as necessary, suggest, implore, assist, and mandate accomplishments. Once the remedy has been deliberated and decided, the activity manager can prepare this information, and the PMO can concentrate on monitoring progress at key dates.