A conditional approval is only safe when each condition is specific, owned, time-bound, testable and tied to the decision. A list of recommendations attached to an approval does not control exposure.
Key judgement
If the condition can remain open without changing the decision, it is probably not a genuine decision condition. Material conditions need explicit consequences if they are not met.
The governance problem
Boards often approve delivery with actions, caveats or management commitments that are not carried into the decision record. The programme moves forward, the actions become part of a general tracker and the original exposure loses visibility. This converts conditional approval into approval by default.
The framework links the assurance finding, the required evidence and the governance consequence. It makes clear what must happen, who owns it, when it must be verified and what the client will do if it is not satisfied.
Four decision outcomes
| Outcome | When it is appropriate | Control requirement |
|---|---|---|
| Approve | Evidence supports the decision and no material unmet condition remains. | Record residual risk and normal monitoring. |
| Approve with conditions | The decision can proceed while bounded limitations are resolved within a controlled window. | Name conditions, owners, dates, closure evidence and failure consequence. |
| Defer | Material evidence or control effectiveness is not yet sufficient to decide. | State exactly what is required before reconsideration. |
| Stop or redirect | The proposed course is unsupported, unsafe or no longer viable. | Record the basis, protect critical services and establish a new decision route. |
Condition types
| Type | Purpose | Example formulation |
|---|---|---|
| Evidence | Resolve a material uncertainty. | Before approval takes effect, provide traceable reconciliation of all material migration exceptions. |
| Control | Demonstrate that a required control operates. | Complete and evidence two successful control cycles with independent review. |
| Dependency | Secure an external or cross-workstream obligation. | Obtain named acceptance of the interface dependency and confirm its achievable date. |
| Readiness | Prove that people, process and technology can operate together. | Demonstrate operational acceptance against agreed service scenarios. |
| Governance | Correct decision rights, escalation or accountability. | Appoint the accountable risk owner and record the tolerance and escalation trigger. |
| Commercial | Connect supplier obligation to evidence and acceptance. | Do not accept the deliverable until the contractual evidence criteria are met. |
Six tests for a valid condition
1. Specific
2. Owned
3. Dated
4. Testable
5. Material
6. Closure defined
- Specific: it identifies the exact gap and required result.
- Owned: one accountable owner is named, even where several teams contribute.
- Dated: the deadline reflects the decision window, not an arbitrary reporting cycle.
- Testable: objective evidence can show whether the condition has been met.
- Material: the condition is necessary to control the decision exposure.
- Closure defined: the verifier and acceptable closure evidence are agreed in advance.
Condition record
| Required field | Purpose |
|---|---|
| Related decision and finding | Maintains traceability to why the condition exists. |
| Required outcome | Describes the result, not merely the action to perform. |
| Owner and due date | Creates accountability within the decision window. |
| Evidence required | Prevents closure through narrative status. |
| Independent verifier | Separates action ownership from closure judgement. |
| Failure consequence | States whether the decision pauses, escalates or changes. |
| Residual risk owner | Records who accepts exposure after verified closure. |
Escalation logic
A missed condition must trigger the consequence recorded at approval. It should not be silently extended by the same delivery forum whose decision it constrains. Where facts have changed, the accountable client can make a new decision, but that decision must be explicit and supported by updated evidence.
Proportionate use
Not every finding requires a decision condition. Observations and routine concerns can remain management actions. Conditions are reserved for matters that affect the validity, timing or risk of a client decision. This keeps governance focused and prevents assurance from becoming an additional project-management layer.
Condition quality test
Replace ‘complete the action’ with the outcome that must be true, the evidence that will prove it and the decision consequence if it is not achieved.
How this standard supports client governance
This standard gives the client a repeatable basis for challenging delivery claims without taking ownership away from the supplier. It enables proportionate scrutiny, records the reasoning behind material decisions and makes residual uncertainty visible to the accountable decision maker.
Use with
Independence safeguard
No practitioner may independently assure delivery that they directly own. Where advisory support and assurance are both required, roles, reporting lines and review responsibility must be separated and recorded.