Gateway Review Checklist: Get Your Pack Green-Ready
A gateway review checklist is a short set of practical checks that get your evidence pack ready for an independent assurance review, before the reviewers arrive. The version that actually protects your rating is not a list of documents to gather; it is a set of consistency checks that make your business case, integrated schedule, risk register, benefits plan and governance pack tell one story. Reviewers form their view by comparing those documents against each other and against the published criteria, so the fastest way to earn a Green is to find and fix the contradictions yourself, while there is still time.
This checklist is written for the senior responsible owner (SRO), programme director or PMO lead heading into a gate. It assumes you already know how the gateway review process works and which gate you are at; if not, start with our full guide to the six gates and the Red/Amber/Green delivery confidence rating, then come back here to prepare.
Reviewers read the pack across documents, not one at a time. Most challenges come from claims that disagree between documents.
The checklist, in short
If you do nothing else, do these eight things. Each is explained in full below.
- Confirm which gate and criteria apply to you, and download the workbook for that gate.
- Map every criterion to the document, and page, that answers it, so nothing looks missing.
- Agree one authoritative baseline for cost, schedule and scope, and minute it if anything changed.
- Trace every benefit to a named owner, a measure, a target and a funded delivery milestone.
- Fund and own your top risks, so the register, the business case and the budget agree.
- Reconcile the documents against each other and fix contradictions before document freeze.
- Show recent stakeholder engagement, including with central agencies.
- Nominate and brief your interviewees, and confirm the schedule with the review team.
Start with the criteria for your gate
Reviewers do not invent their questions. Each jurisdiction publishes workbooks that set out the criteria and the kinds of evidence expected at each gate, and the review team works from them. In the Australian Government, the process and financial thresholds are set out in Resource Management Guide 106 (RMG 106); the states run their own units and workbooks, Infrastructure NSW, the Victorian gateway review process, Queensland Treasury and the Western Australian Gateway Unit among them. Thresholds differ: in Western Australia, for example, an agency must undertake at least two gateway reviews, one of them at the business-case gate, for infrastructure projects valued at $100 million or more and ICT projects of $10 million or more. Before you assemble anything, find the workbook for your gate and read the criteria the way the reviewers will.
Then do the single most useful piece of preparation: map each criterion to the document, and page, that answers it. This is quiet work that pays off twice, it tells you where your evidence is thin while you can still strengthen it, and it lets you point the review team straight to the answer instead of leaving them to hunt. If a criterion has no clear home in the pack, that is a gap to close now rather than explain in review week.
Make the pack consistent: a document-by-document check
Reviewers rarely challenge a pack for a missing document. They challenge contradictions between documents and benefits that are asserted but not funded. For an investment-decision gate, a pack commonly spans the business case, the integrated schedule, the risk register, the benefits realisation plan, the governance pack and stakeholder material. Read each one for what it must establish, and, more importantly, for where it must agree with the others.
| Document | What it must establish | Where it must agree with the rest of the pack |
|---|---|---|
| Business case | The case for investment: the need, the options considered, the preferred option, costs and value for money. | Dates and assumptions match the schedule; costs match the funding profile; risks and benefits appear here too. |
| Integrated schedule | A credible path to delivery with the critical path and key milestones, contract award, go-live, benefit dates. | Milestone dates match the business case and procurement plan; benefit-enabling milestones are actually in the plan. |
| Risk register | The top risks, with named owners, treatments and residual ratings. | The material risks are reflected in the business case, and their treatments are funded in the budget and schedule. |
| Benefits realisation plan | For each benefit: an owner, a measure, a baseline, a target, the milestone it depends on and where it will be reported. | Each benefit traces to a funded milestone in the schedule and to the value case in the business case. |
| Governance pack | Roles and decision rights, delegations, the SRO appointment, and board minutes for key decisions. | The decisions referenced elsewhere in the pack actually appear in the minutes and delegations. |
| Stakeholder material | Recent evidence of engagement with the stakeholders who matter, including central agencies. | Commitments made to stakeholders are reflected in the schedule, scope and risks. |
The test is simple to describe and easy to fail: could a stranger read any two documents side by side and find them telling the same story? If your business case assumes a September contract award but the schedule and procurement plan say November, that inconsistency will be found, and it is far cheaper to fix now than in review week.
A timeline for the weeks before your review
Gateway reviews work best when they are scheduled roughly four to six weeks before the decision they support, which leaves time to act on what is found. Work back from that date.
Six to eight weeks out
Complete the Risk Potential Assessment Tool (RPAT) or your jurisdiction's equivalent, which helps decide the level of assurance recommended, and agree the review date, gate and scope with your gateway unit. Nominate a single project contact to coordinate with the review team leader, and get the likely interviewees' diaries held early, availability is the most common scheduling headache.
Two to three weeks out, before document freeze
Run your own cross-check: a dry run of the review against the criteria. Reconcile the documents against each other using the table above, close any criteria with no clear evidence, and minute the decision if a baseline has changed. This is the phase that moves a pack from Amber towards Green, because it is the only point where you can still act on what an honest read turns up. Freeze the pack only once it is internally consistent.
The planning meeting and review week
The review team, usually four independent reviewers, normally holds a planning meeting one to two weeks beforehand to get an overview and start reading, then spends around three to five days on the review itself. Keep the pack stable after freeze; a document that changes mid-review undermines the team's confidence in everything around it. For the full rhythm of review week, see our guide to how assurance reviews work.
After the report
You will get a draft report with findings, recommendations and a Red/Amber/Green rating. Fact-check the draft for accuracy, the goal is to correct genuine errors of fact, not to soften findings, and, for any Red or Amber/Red recommendation, prepare an action plan with owners and dates. That action plan is usually what a follow-up review checks.
The people, and how the interviews work
The SRO nominates the interviewees: members of the project and governance groups, plus the internal and external stakeholders who matter. Two points reassure teams. First, the interviews are confidential, two-way discussions, and they are non-attributable so people can speak frankly. Second, interviewees need no special preparation, they are asked about the project they already know, not tested on the pack. Brief your people to be candid rather than defensive; a review that hears the real issues is far more useful than one that is managed into telling you what you hoped to hear.
Why packs get an Amber or Red
International studies into why major projects struggle point to a recurring set of causes, and they map closely onto what reviewers challenge: a weak link between the project and clear strategic priorities and measures of success; no clear break of the work into manageable, deliverable steps; poor governance around scope, selection and procurement; a business case that is not robust or properly reviewed; gaps in project and portfolio capability; and benefits that are vaguely defined, unmeasured or unowned. In practice the most common failures are not missing documents but contradictions between them, and benefits asserted without a funded milestone behind them. Our pillar guide covers why packs get an Amber or Red in more detail.
Where an independent pre-review fits
The hardest item on this checklist is the one you cannot really do to yourself: reading your own pack the way an outsider will, across documents and against the criteria, without the benefit of knowing what you meant. That is what Assay does, a fixed-scope, document-based pre-review that returns the missing evidence, contradictions and weak criteria coverage in your pack, with page-level citations for each finding, within 48 hours of an accepted pack. It does not replace the independent review team, conduct interviews or predict the final outcome; it shows where your pack is likely to be challenged while you can still act. You can see a sample pre-review report to understand the format, or join the early-access waitlist. Assay is currently invite-only and not yet accepting client documents.
Frequently asked questions
What is a gateway review checklist?
A short, practical set of checks that get your evidence pack ready for an independent gateway or assurance review. The most useful version is not a document shopping list, it is a set of consistency checks that make your business case, schedule, risk register, benefits plan and governance pack tell one story against the criteria for your gate.
How do I prepare for a gateway review?
Confirm your gate and its criteria, map each criterion to the document that answers it, agree one authoritative baseline for cost, schedule and scope, trace every benefit to a funded milestone, and reconcile the documents against each other before document freeze. Nominate and brief your interviewees, and schedule the review about four to six weeks before the decision it supports.
What documents go in a gateway review evidence pack?
For an investment-decision gate a pack commonly spans the business case, the integrated schedule, the risk register, the benefits realisation plan, the governance pack and stakeholder engagement material. Exact contents vary by gate and jurisdiction, so work from the workbook for your specific gate.
How far in advance should I prepare the pack?
Schedule the review roughly four to six weeks before the decision it supports so there is time to act on the findings, and run your own cross-check two to three weeks before document freeze. Complete your risk-potential assessment and agree the scope with the gateway unit earlier still, around six to eight weeks out.
Do interviewees need to prepare?
No. Gateway interviews are confidential, two-way discussions and require no special preparation, interviewees are asked about the project they already know. The most useful thing you can do is encourage them to be candid rather than defensive.