Notes from inside the work.

Remediation plans are usually written to be complete. Every article of the order is answered, every commitment has a date, and the document is defensible on paper. What that approach rarely considers is which commitment lands first — and that is the one your supervisor will use to calibrate how closely to watch everything else.

Choose a first milestone you control end to end. Not the one that is most urgent in substance, and certainly not the one that depends on a vendor, a hiring decision, or a system release. Choose something where the work, the evidence, and the sign-off all sit inside your own accountability, so that delivering it on the day is a matter of discipline rather than luck.

Then over-build the evidence for it. Not more work — more legibility. A reviewer should be able to trace the commitment to the activity, the activity to the artefact, and the artefact to the person who attested it, without asking you a single clarifying question. The message that sends is not "we finished a task." It is "this organization can be relied on to describe its own position accurately," and everything that follows becomes cheaper.

The inverse is equally true and considerably more expensive. Miss the first one, or deliver it with evidence that has to be explained, and the remaining eighteen months are conducted under a level of scrutiny that changes what your team can get done in a week.

By the time a program turns amber it has usually been in difficulty for two months. The useful signals are behavioural, and they are all observable before any measure moves.

First: decisions are re-litigated. The same question appears in three consecutive forums because nobody has the authority to close it. Second: the plan grows detail at the front and loses it at the back — a sign the team is managing the next two weeks and hoping about the rest. Third: dependencies are described as risks. A dependency with a named owner and a date is a commitment; a dependency in the risk log is an unowned assumption.

Fourth: status is negotiated before the meeting rather than reported in it. Fifth: the people who know the most talk the least in governance forums, which means the room has stopped being safe. Sixth: evidence is being produced retrospectively — someone is reconstructing what happened rather than capturing it as it happens, and that is the clearest indicator that the operating model is not doing its job.

Any two of these together warrant an independent look. Not a review that takes six weeks and produces a maturity score — a fortnight, three questions, and a written position your executive committee can act on.

Most PMOs are measured on the timeliness and consistency of their reporting. That is a reasonable thing to want and a poor thing to optimise for, because it makes the function's purpose the description of progress rather than its production.

A PMO built as a decision engine looks different. Every forum has a stated set of decisions it exists to make, and an agenda that consists of those decisions rather than a tour of workstreams. Every open decision has an owner, a date by which it becomes expensive, and a visible record of what it is waiting on. The reporting is a by-product: if you know what decisions are outstanding and what they are blocking, status writes itself.

The practical test is simple. Ask how many decisions the last steering committee actually closed. If the honest answer is zero, the forum is a briefing, and the program is being run somewhere else — usually in corridors, at a pace nobody is managing.

The failure mode is almost never a refusal to cooperate. It is helpfulness. The first line is under-resourced, the deadline is real, and the second line has the expertise — so it writes the procedure, populates the assessment, and drafts the remediation plan it will later be asked to review.

Nothing looks wrong for a year or two. Then an examiner asks who performed the control and who challenged it, and the answer is the same name. At that point the finding is not about a control gap; it is about the credibility of the entire governance model, which is a materially worse conversation.

The fix is unglamorous: define responsibilities against real activities rather than against job titles, state explicitly what effective challenge consists of and where it is recorded, and give the first line enough capacity that the second line's help is not structurally required. Every one of those is a resourcing conversation dressed as a governance one, which is precisely why it keeps getting deferred.

Interim leadership is the right answer when the seat carries live commitments, the search will realistically take four to six months, and the alternative is asking someone to hold two jobs badly. In that situation an experienced interim with real decision rights protects both the program and the eventual hire.

It is the wrong answer when the underlying question is whether the role should exist in its current shape, or when the organization is using the interim to postpone a difficult structural decision. In those cases the interim becomes a permanent fixture, the decision gets harder each quarter, and the cost compounds quietly.

Two conditions make the difference. Define the end state at the start — what the permanent holder inherits, and in what form. And build the handover pack from week one rather than week thirty, so that whoever arrives inherits an organised function instead of an archaeological site.