Every failed programme I have reviewed had a governance framework. Most had a good one. The framework was rarely the problem.
A framework describes how decisions should be made. A board needs to know how they are actually being made. Those two drift apart quietly, and the reporting pack is the last place it shows.
Here are six questions that surface the drift. None require technical knowledge. All are uncomfortable to answer badly in a room, which is the point.
1. Who approved the last scope change, and on what date?
If this takes more than a few seconds, decision rights are unclear. If the answer names a committee rather than a person, they are unclear in a way that will not survive an audit. Committees deliberate. People decide, and only people can be asked why.
2. Which of our top five risks has a named owner who could be called today?
Not a function. Not a department. A person. A risk owned by “IT Security” is owned by nobody, and it will be reviewed monthly until it is closed for lack of interest rather than lack of exposure.
3. What evidence would prove that our most important control is working?
If the answer is the policy describing the control, there is no evidence. Policies describe intent. Evidence is a log, an approval record, a test result, a dated sign-off. Regulators increasingly ask for the second thing, and that gap is where most organisations find out they are less ready than their documentation suggests.
4. Where is the programme against its milestones, and who told us?
Status that flows up through the delivery team it describes is not independent. That is not an accusation of dishonesty. It is how reporting works. Nobody volunteers bad news about their own work early, and the incentive compounds the longer a slip goes unreported.
5. What is our longest open decision, and what is it blocking?
Decision latency is the most underrated metric in programme governance and almost nobody tracks it. Work does not stop while a decision is pending. It carries on in a direction that may have to be undone, and undoing it gets more expensive daily.
6. If our main vendor withdrew next quarter, what would we do?
Third-party concentration is the risk boards consistently discover after the fact. The answer does not need to be a full exit plan. It needs to be more than a pause.
None of these questions is clever. That is deliberate. Clever questions produce clever answers and clever answers hide things.
If a leadership team answers all six quickly and consistently, the governance is probably real. If two executives in the same room give different answers, that is the finding, and it is usually available within a fortnight.