Who decides when evidence and risk are fragmented?

How fragmentation develops

Programmes deliberately distribute work across business, technology, risk, finance, suppliers and operations. The problem begins when each function confirms only its own slice and nobody converts contradictions into an overall decision. Everything is locally owned, while the decision is globally unowned.

Separate accountability from evidence roles

A clear model names the Decision Owner, Risk Owner, Evidence Owner and Control Owner. One person may hold more than one role, but the roles must remain visible. UK project-delivery guidance makes the Senior Responsible Owner accountable for successful objectives and executive leadership while specialists provide evidence.

The Orange Book and IIA Three Lines Model distinguish management ownership, second-line support and monitoring, and independent assurance. Assurance does not assume the management decision.

Build a decision record

The record should identify the claim, source, currency, uncertainty, owner, dependency and consequence. Contradictions remain visible until the forum resolves them. A consolidated traffic-light score must not hide evidence provenance.

Warning signs

Warnings include a RACI without a named decision owner, risks without acceptance dates, evidence without owners, controls without an operating owner, or minutes that record discussion but no decision and no conditions.

Questions for management

Who signs the specific decision? Who owns residual risk? Which evidence is independent? Who can reject a claim? Which open points are conditions and which are observations?

When independent review may help

A Critical Programme Decision Review does not add another organisational layer. It assembles distributed evidence along the decision line, tests critical claims and makes remaining uncertainty and accountability explicit in the Decision Memorandum.