Governance Protects the Boundaries.
One of the key functions of project assurance and governance rarely gets said out loud: it exists to protect boundaries. Not to police people, not to slow anyone down — to protect the line between what’s approved and what isn’t, between whose call something is and whose it never was. When that line gets muddied, or broken, or quietly stepped over often enough that nobody bothers naming it anymore, an organisation doesn’t fail all at once. It accumulates a multitude of problems it hasn’t had to wake up to yet.
Accepting a broken boundary is not a neutral act. It’s an act of complacency, and complacency is contagious. Take a steering committee whose charter says any budget variance beyond 5% needs sponsor sign-off before work proceeds. First time the number comes in at 6%, someone on the committee says it’s close enough, the paperwork can catch up later, everyone’s got bigger things to worry about this week. Nobody voted to remove the threshold. They just didn’t enforce it once. That’s the entire mechanism, and it’s usually reasonable-sounding enough that nobody in the room feels like they’ve done anything.
The second breach is cheaper than the first, and the tenth is free. The next milestone comes in at 9%, and the precedent is already set — this is a committee that doesn’t really enforce that clause. By month eight, the sponsor is looking at a program running 40% over baseline, and there isn’t one decision anyone can point to that explains it. There’s a long chain of small, defensible-sounding exceptions, each one invisible on its own, each one made because raising the boundary felt like more friction than the moment seemed to warrant.
This is what “things went out of hand” actually looks like from the inside — not one bad call, but the slow disappearance of anyone whose job it was to say “that’s not yours to approve.” Go looking for the moment direction and control were lost and you won’t find it in the minutes, because it didn’t happen in a moment. It happened in the sum of moments nobody treated as consequential at the time.
This is the actual job of governance — understanding which boundaries matter, monitoring them, and protecting them before drift becomes the culture. Role and responsibility. Thresholds for approval, for risk, for who genuinely gets to decide what. Escalation paths people actually use, rather than ones that exist only in the document nobody reopens after kickoff. None of these boundaries announce themselves. None of them are dramatic. That’s exactly what makes them easy to lose.
Boundaries are subtle. That’s precisely why they need to be made explicit — because nobody notices a boundary until the day it’s gone. So the real test of governance isn’t whether the framework lists the right boundaries. It’s whether anyone still says something the third time a small exception gets waved through, or whether by then waving it through has quietly become the process itself.
