Gateway Review – Lessons Learned Report 
(second edition)

The Gateway Reviews

This report presents the lessons learned from the Australian Government’s Gateway reviews. Gateway is a project assurance methodology that involves short, focused reviews at critical points in the project's life-cycle by a team of reviewers not associated with the project. Lessons learned are observations gained from Gateway reviews which highlight opportunities for project management improvements in Australian Government agencies. 

A total of 88 reviews across 33 projects have been completed in the first three years of operation of Gateway.

This is the second lessons learned report and it considers 56 Gateway reviews conducted across 24 projects and 11 agencies during the 2007-08 and 2008-09 financial years. 

Reviews conducted during 2007-08 were predominantly at the projects’ procurement stages (Gates 2 and 3). During 2008-09 there was an increase in Gate 3, 4 and 5 (investment decision, readiness for service and benefits realisation) reviews as more projects progressed to these later gates. These factors contributed to some differences in the key themes observed between the first and this second lessons learned report.

Good Practice

Many of the lessons learned in the second and third years of Gateway were positive. The review reports identified several agencies that delivered successful project outcomes through sound project management principles. These agencies generally share the following good practice fundamentals, encompassing many of Gateway’s key themes:

•	senior executive and whole-of-organisation support a project management approach to delivering on government priorities
•	governance arrangements  are defined and agreed – especially where accountabilities are shared across multiple stakeholders - with direct links to the agency executive/s 
•	business cases outline the project scope with achievable outcomes and are routinely monitored and revisited 
•	benefits realisation plans are measurable to allow for ongoing tracking and reporting 
•	stakeholder management and engagement is ongoing throughout all phases of the project, ensuring roles and responsibilities are understood and acknowledged, and
•	project teams have appropriate skills and the charter to deliver on the objectives. 

Key Themes

The Gateway reviews finalised in 2007-08 and 2008-09 made a total of 597 recommendations. The lessons learned presented in this report are grouped across seven key themes: 

1.	Project Planning and Management (27 per cent)
2.	Business Case and Benefits Realisation (16 per cent)
3.	Governance (14 per cent)
4.	Stakeholder Management (13 per cent)
5.	Service Delivery (12 per cent)
6.	Sourcing Strategy (11 per cent)
7.	Risk Management (7 per cent)

1.	Project Planning and Management
Twenty-seven per cent of all recommendations across 49 reviews focused on project planning and management issues. This represents an 8 per cent reduction on the first year of Gateway implementation, with review findings indicating an improvement in establishing projects and maintaining project documentation. 

The lessons learned include:
•	project documentation should be maintained throughout the life-cycle of the project - particularly where the project has multiple phases and activities that advance at different rates
•	implementation schedules should have practical, executable stages that encompasses business, infrastructure, procurement and stakeholder requirements
•	project costs must be monitored and reported with contingency funding being linked to project risks, and
•	project document management controls should be used, including hierarchy, revision and approval arrangements. 

Case Study 1 – Project planning and management (Agency A)
The review team found that Agency A’s project planning and management exhibited many characteristics of good practice. 

In particular, the report commented that the documentation:
•	articulated Government and project objectives and timeframes
•	identified internal and external factors, including risk and critical success factors which may impact on the project
•	provided budget guidance for the participating agencies
•	included collaboration (engagement) with key stakeholders, and 
•	established high-level governance strategies.

In addition, the project appeared to be well understood and supported by the stakeholders interviewed. Contributing to this was the agency’s commitment to refine and update its project management strategies as the project progressed through its lifecycle, including:
•	an Interdepartmental Committee – so that senior executives could focus on providing strategic guidance and endorsement as appropriate, and
•	multiple working groups with inter-departmental representation – which could provide focus on the delivery of assigned tasks and products (eg. policy and technical).

2.	Business Case and Benefits Realisation
Sixteen per cent of all recommendations related to the project business case and benefits realisation planning and were spread across 50 reviews. These management tools represent the two ends of the project life-cycle – with the latter ideally achieving outcomes identified in the former. It is therefore important that throughout all project phases, staff and stakeholders have a common understanding of the business need and objectives and how to follow the critical path towards benefits realisation. Despite representing only 9 per cent of all reviews, reviews conducted at the Gate 5 (benefits realisation) stage accounted for 31 per cent of these recommendations and were related, in particular, to projects with complex ICT components.

The lessons learned include:
•	project benefits should be unambiguous, concise, achievable and verifiable and monitored throughout all phases of the projects’ life-cycle
•	the business case should be routinely updated to take into account the projects’ progress – especially in regards to budget, scope and timing
•	interdependencies between agencies or jurisdictions and how they will be managed should be clearly defined, and 
•	benefits and savings should be identified when decommissioning superseded ICT systems from increased integration and interconnectivity between agencies and jurisdictions.

3.	Governance

Fourteen per cent of all recommendations related to governance, and were relevant to 45 reviews. These recommendations encompass all aspects of structure and decision-making for the successful and transparent management of a project. 

Overall, the Gateway reviews found that projects have established governance frameworks and that progress is being monitored actively. However, recommendations in 27 per cent of the reviews identified that projects needed some improvement in reporting and accountability to promote better transparency and allow senior stakeholders to effectively manage risk.

The lessons learned include:
•	information about risks, key business drivers and expected outcomes and how they contribute to the business objectives, should be provided to the project board and/or executive committee so it can support decision-making throughout all phases of the project, and
•	restructure the project team and revise the business engagement approach as necessary – ensuring that the agencies that are actively involved have a common understanding of roles, responsibilities and ownership of the project deliverables. 

This first lesson above is consistent with the overall theme that, as the project moves through its life-cycle, project materials need to be updated and better maintained to reflect current and emerging project activities – and to assist the senior stakeholders in managing project risk 

Several projects reviewed by Gateway have adopted the proactive approach identified in the second lesson. This has improved capability and facilitated the timely and transparent management of key issues and risks, assisting the project to maintain focus on the achievement of its core deliverables. 

Case Study 2 - Governance arrangements (Agency B)
The review team noted that the Agency B project was well managed with a well established and understood project and program environment.
The governance arrangements included the use of Steering Committees and Working Groups to manage expectations across multiple stakeholders. These arrangements were put in place with a clear agenda from which to identify, specify and manage the projects’ risks. 
In addition, Memorandums of Understanding (MOUs) with third party providers were being developed as the project moved to the procurement stage to clarify roles, responsibilities and accountabilities amongst third party providers, and to assign and mitigate risks.
4.	Stakeholder Management

Identifying and effectively managing key stakeholders is essential to project success. Approximately 13 per cent of all recommendations related to stakeholder management.

In general, the reviews found that projects follow good practice by actively identifying and engaging stakeholders in a variety of ways - tailoring the approach to meet the specific needs of their diverse audiences. However, 43 reviews received at least one recommendation that aimed to improve stakeholder engagement – review teams noted this most often in relation to the larger and more complex projects, involving multiple agencies and/or jurisdictions.

The lessons learned include: 
•	the impacts the project may have will be better understood by actively engaging and responding to stakeholders 
•	roles, responsibilities, authority and decision-making processes and reporting requirements should be clearly defined and communicated amongst stakeholders
•	practical and targeted strategies aligned with the business case should be established to manage diverse stakeholder expectations, and
•	communications to align with the various stages of the project life-cycle (e.g. design, build and implementation) should be tailored for stakeholder groups.
Case Study - 3 Stakeholder management (Agency C)
The review team found that Agency C demonstrated good practice in stakeholder management arrangements. The agency hosted Inter-agency Workshops and User Groups, which sought to ensure that all key stakeholders were engaged throughout the project and were active in contributing to the business requirements, identifying benefits as well as identify and manage risks.
In addition, stakeholders were able to agree on critical paths for the integration of ICT systems both inter and intra-departmentally. This helped to manage the risk of cost over-runs associated with related data cleansing, migration and the decommissioning of old ICT systems, where costs can often be underestimated.

5.	 Service Delivery 
Twelve per cent of all recommendations spreading across 43 reviews focused on service delivery issues and matters relating to project implementation. Thirty-six per cent of these recommendations featured in Gate 5 (benefits realisation) reviews. 

The reviews identified that some projects reviewed at, or leading up to, Gate 4 (readiness for service), faced challenges with project scheduling and implementation planning. Varying degrees of operational readiness, capability and capacity was particularly evident across projects involving multiple agencies and/or jurisdictions. Project managers are encouraged to concentrate on completing project tasks on the critical path, with continued attention to risk management, stakeholder management, governance and contingency planning. 

The lessons learned include:
•	appropriate resources and mechanisms (capability and capacity) should be in place to assess, prioritise and effectively manage project tasks
•	clarity is required on who needs to be involved and when and what they must deliver
•	adequate contract management strategies, plans and negotiation directives should be in place prior to contract negotiations
•	risk management should consider specific service delivery risks, such as  the affect of cancelling, delaying or proceeding with implementation
•	internal and external stakeholders should be actively engaged to develop, finalise and agree upon service delivery and implementation arrangements, and
•	business-as-usual and operational governance arrangements must be agreed before being implemented.

6.	Sourcing Strategy

Eleven per cent of all recommendations related to sourcing and procurement issues, and applied to 38 reviews. Seventy-four per cent of these recommendations were made at the Gate 2 and 3 stages (sourcing and investment decision respectively). 

The review findings broadly demonstrated that projects are actively managing procurement processes in accordance with government policy. Where appropriate, tender documentation is being developed correctly, evaluation arrangements are being established and probity matters are being managed.  

However, the review recommendations identified that projects could apply more rigour to the development of sourcing strategies and contract management by: actively identifying and managing risks; ensuring that requirements are well articulated; and establishing a direct link between the procurement of goods and services and the overall project objectives.

The lessons learned include:
•	the purpose and objectives for each procurement and the likely evaluation approach should be clearly defined – ensuring clarity of requirements, scope, timing and priorities 
•	market analysis and evaluation of cost (service/product costs, implementation and maintenance costs, and value for money) should give due consideration to:
o	examining similar procurements within government
o	understanding the capacity of the market to deliver, and
o	assessing possible suppliers’ track record
•	the likely impact of implementing the sourcing strategy should be determined
•	potential risks to the supplier and the agency associated with the potential engagement should be clearly identified
•	appropriate service level arrangements should be identified and monitored, with ongoing two-way communication between stakeholders and suppliers to measure performance, and
•	contract management expertise should be employed to assist, where necessary, with negotiation, evaluation and/or assurance activities.

7.	Risk Management 

Seven per cent of all recommendations related to risk management and applied to 39 reviews, providing an indication that, on the whole, projects are identifying and managing risks relatively well. 

The reviews found that while projects generally had established risk management plans, these were often undertaken at a whole-of-project level and were often not being adequately utilised, monitored or updated. The risks attributable to policy or business change - such as system integration and information sharing and the related data migration and cleansing – must not be underestimated.

The lessons learned include:
•	project managers need to conduct robust risk assessment and monitoring, and report on the outcomes of these assessments to project steering committees and senior stakeholders on a regular basis
•	complex programs (including those with multiple sub-projects and those affecting multiple agencies, stakeholders and jurisdictions) must ensure risks are properly allocated and managed
•	senior level staff should be involved during the definition, planning and management of risks/issues and agree escalation and approval processes
•	risk owners should be clearly assigned so that accountability mechanisms are in place and escalation processes should be documented to adequately treat and mitigate risks 
•	a financial evaluation of project risks should be conducted (which also helps with prioritisation and quantifying contingency funding requirements), and
•	additional specialist staff should be employed, as necessary, to focus on project, risk, contract and organisational change management, as well as negotiation and stakeholder communications.

About Us

The Gateway Unit identifies lessons learned by reviewing Gateway review reports from completed reviews, and through ongoing communication with agencies and Gateway reviewers. We identify trends in emerging issues through recommendations to improve deficient practices; or through recognition by a review team of good practice already being applied by an agency to a project.

Gateway provides agencies with an opportunity to receive an independent perspective on their project, along with action-oriented recommendations to enhance the prospects of success. Gateway reviews are set apart from other forms of project assurance, as they are undertaken by a team of experienced peer reviewers who are not associated with the project. The review teams consist of a mix of public sector and private sector reviewers who contribute different skills and experience to the review. The review provides a point-in-time look at the project focused predominantly on the current gate. 

Better Practice Guidance

Australian Government
Australian National Audit Office/Department of Finance and Deregulation, Better Practice Guide: Developing and Managing Contracts, February 2007 
Australian National Audit Office/Department of the Prime Minister and Cabinet,
Better Practice Guide: Implementation of Programme and Policy Initiatives, October 2006
Australian National Audit Office, Better Practice Guide: Public Sector Governance, July 2003
Australian National Audit Office, Better Practice Guide: Business Continuity Management – Building resilience in public sector entities, June 2009
Department of Finance and Deregulation, Commonwealth Procurement Guidelines, January 2005
Department of Finance and Deregulation, Guide to ICT Sourcing for Australian Government Agencies, September 2007
Department of Finance and Deregulation, ICT Business Case Guide: Development and Review, November 2008
Department of Prime Minister and Cabinet, Guide to Preparing Implementation Plans

UK Government
Office of Government Commerce UK, Management of Risk: Guidance for Practitioners 2007
Office of Government Commerce UK, Managing Successful Programmes 2007
Office of Government Commerce UK, Managing Successful Projects with PRINCE2 2005

Standards Australia
Standards Australia, AS/NZS 4360:2004: Risk Management, 2004
Standards Australia, AS8000-2003: Corporate Governance – Good Governance Principles, 2003
Standards Australia, AS8015-2005: Corporate Governance of Information and Communication Technology, 2005
Standards Australia, AS ISO/IEC 20000.1-2007, Information Technology – Service Management
Standards Australia, HB 221:2004: Business Continuity Management
Standards Australia, PE 026-2007: The Definitive Guide to Project Management

Project Management Institute
Project Management Institute, Project Management Body of Knowledge Third Edition (PMBOK® Guide)
Project Management Institute, Construction Extension to the PMBOK® Guide Third Edition
Project Management Institute, Government Extension to the PMBOK® Guide Third Edition
Project Management Institute, The Standard for Program Management

Further Information:
Website: http://www.finance.gov.au/gateway
Email: gateway@finance.gov.au

Gateway Unit
Gateway and Training Branch, Financial Management Group
Department of Finance and Deregulation
John Gorton Building, King Edward Terrace
PARKES ACT 2600

© Commonwealth of Australia 2009

ISSN: 1837-7742

Department of Finance and Deregulation 
Financial Management Group

This work is copyright. Apart from any use as permitted under the Copyright Act 1968, no part may be reproduced by any process without prior written permission from the Commonwealth. Requests and inquiries concerning reproduction and rights should be addressed to:

Commonwealth Copyright Administration,  
Attorney-General’s Department, 
Robert Garran Offices, 
National Circuit 
Barton ACT 2600

or posted at: http://www.ag.gov.au/cca.
and inquiries concerning reproduction and rights should be addressed to: