TL;DR
- A green milestone status is not the same as evidence that controls are operating. Leaders need to see what was reviewed, what remains open and who owns the response.
- Connected assurance links milestone decisions to risks, controls, evidence, findings, and approvals across workstreams and suppliers.
- 6clicks Intelligent GRC helps validate submitted control evidence and surface gaps for human review. It supports—not replaces—independent reviews and accountable decision-makers.
A major development programme reaches a milestone. Workstream reports are green, contractors have submitted documents, and the steering committee is preparing to approve the next phase.
Then a reviewer asks: what evidence supports that status?
One team points to a checklist. Another has a test report in a shared drive. A supplier’s attestation covers a different scope. An exception was accepted in an email, but its owner has moved to another workstream.
Giga-projects, which are exceptionally large, complex developments involving multiple projects, partners, and long time horizons, depend on thousands of decisions. Leaders need to know whether the evidence behind a critical decision is relevant, current, and clear enough to examine.
That is the difference between reporting progress and assuring it.
In addition, assurance gets harder as programmes grow. Design, construction, procurement, technology, safety, and operations teams may have different controls, reporting cycles, and evidence sources. A milestone can depend on several of them at once. If each uses a different definition of “complete,” an overall status can conceal uncertainty.
Project assurance is a structured review that helps decision-makers understand readiness to proceed and the gaps needing attention. Evidence-backed assurance connects the decision to underlying records rather than relying on a status alone.
The UK’s 2026 major-project assurance toolkit sets out different reviews for different stages, from strategic assessment to readiness for service. It illustrates why assurance questions change through a project’s lifecycle.
A practical assurance chain:
Milestone decision → relevant risk → control and owner → evidence → review finding → action or exception → decision record
Evidence should be proportionate to the decision and risk. A procurement gate will not necessarily need the same proof as a technology handover.
Here are key considerations to include in your assurance processes:
Start with the decision, its material risks, and dependencies. Identify the control intended to address each risk, its owner, and the review that will assess it. Where several teams contribute, distinguish the control owner from the people supplying evidence so that gaps do not fall between workstreams.
An uploaded document is not automatically sufficient. A policy may describe what should happen without showing that it happened. A supplier certificate may cover the wrong service. A test may predate a significant change.
Ask whether the evidence is:
Some controls also require specialist interpretation, inspection, or independent testing.
A design change, new supplier, or revised system configuration may affect whether earlier evidence still applies. Agree which changes trigger reassessment, who makes that call, and where the decision is recorded. The objective is proportionate review, not re-testing everything after every change.
For Saudi organisations, cybersecurity may be relevant at technology milestones. The National Cybersecurity Authority’s 2026 ECC implementation guide addresses security in information and technology project and change management, including vulnerability assessment and remediation. Its scope follows ECC-2:2024 and covers specified government entities and private-sector entities owning, operating, or hosting critical national infrastructure. Assess applicability for the organisation and activity; not every project or supplier is automatically in scope.
A programme may rely on a contractor to operate a control, maintain an asset, or address a finding. For each material dependency, identify the supplier and service, the control supported, the evidence received, its review date and scope, and any open gap with an owner and escalation route.
A supplier assessment can inform a decision, but it is not proof of every programme control. Check what it covers and follow through on exceptions.
For material findings, show the potential impact, owner, target date, interim measures, and any authorised risk acceptance. If evidence is missing, it should be clearly communicated. If progression depends on an action being completed, record that condition.
A summary may be green under agreed criteria, but decision-makers should be able to understand why and what the status does—and does not—cover.
Consider a fictional infrastructure programme preparing to hand over a connected facility. The decision is whether a defined technology environment is ready for the next phase.
| Assurance question | Example evidence | What the reviewer checks |
|---|---|---|
| Are access responsibilities clear? | Approved access matrix and recent access review | Scope, date, owner, and open exceptions |
| Have material vulnerabilities been assessed? | Assessment, remediation records, and approved exceptions | Outstanding findings and escalation needs |
| Are supplier responsibilities understood? | Responsibility matrix and supplier assessment | Whether the evidence covers the service and period |
| Is the operating team ready for handover? | Handover checklist, issue register, and acceptance record | Conditions, owners, and open issues |
A full readiness decision may also require engineering, safety, operational, and independent specialist reviews. Connecting the evidence helps reviewers find missing or out-of-scope material before the gate decision.
6clicks Intelligent GRC brings controls, tests, evidence, frameworks, and assurance activities into a connected governance environment. Programme teams can use it to:
AI supports reviewers; it does not make the milestone decision. Programme leaders and specialists remain accountable for evaluating findings and approving progression. As sovereign GRC infrastructure, the platform adapts to the organisation’s environment and operational requirements.
Choose an upcoming decision and a manageable set of material controls:
Giga-project leaders do not need more documents for their own sake. They need to understand what those documents support, what they leave unanswered, and what happens next.
Explore 6clicks Intelligent GRC to see how connected controls and intelligent evidence validation can support your next assurance review.