Gateway Review Process: How Assurance Reviews Work
A gateway review is a short, independent peer review of a major project or programme, run at a key decision point to tell the people accountable for it whether the work is genuinely set up to succeed, before money is committed to the next stage. A small team of reviewers who are not connected to the project reads the evidence, talks to the right people, and gives a plain verdict on how confident they are that it will be delivered on time, on budget and to scope.
If you are a senior responsible owner (SRO), programme director or PMO lead heading into one of these reviews, this guide explains how the process actually works: who runs it, the six gates, what happens during review week, how the Red/Amber/Green rating is decided, and, most usefully, how to get your evidence pack ready so the review confirms what you already know rather than exposing surprises.
What is a gateway review?
The gateway review process was developed by the United Kingdom's Office of Government Commerce (OGC) in the early 2000s and is now used by governments around the world to add scrutiny and oversight to major projects across their whole lifecycle. It works by mandating a series of reviews by a panel of independent experts at set stages, checking that objectives are clear, that problems found so far have been fixed, that planning is sound, and that the project is still likely to deliver its intended benefits.
Two things about gateway reviews trip people up. First, a gateway review is not an audit, a technical review or an inquiry, it is a forward-looking exercise designed to focus the team's effort on the issues that most affect success. Second, gateway reviews do not pass or fail a project. Even when a review finds serious problems, the project does not automatically stop; it means major risks and issues need to be addressed so the project is less likely to fail. The SRO remains accountable for the project and decides whether and how to act on the recommendations.
Who runs gateway reviews, and when are they required?
In Australia, the Australian Government process is administered by the Department of Finance and set out in Resource Management Guide 106 (RMG 106). Finance may recommend that a high-risk New Policy Proposal be subject to gateway when it requires government approval and meets set financial thresholds:
- projects with a total cost estimated at $30 million or more for procurement or infrastructure; or
- projects estimated at $30 million or more that include an ICT component of at least $10 million; or
- programmes with a total cost estimated at more than $50 million.
Risk is judged with a standardised tool, the Risk Potential Assessment Tool (RPAT), and the resulting rating helps decide whether additional assurance is recommended to government.
Gateway is not unique to the Commonwealth. The states run their own gateway units and thresholds, for example, Infrastructure NSW, the Victorian gateway review process, and Queensland Treasury, where gateway is recommended for projects estimated to cost more than $100 million. The United Kingdom, New Zealand and other jurisdictions run comparable processes based on the original OGC model.
The six gates, explained
Gateway structures its reviews around the decision points in a project's life, called gates for projects and stages for programmes. The classic OGC model has six reviews. The focus of each is consistent across jurisdictions, even though the exact numbering and names vary (more on that below).
| Gate | Common name | What it checks | Typical decision point |
|---|---|---|---|
| 0 | Strategic assessment / business need | Confirms the scope and purpose are sound, fit the wider strategy, and that expected benefits have been identified. Repeated over a programme's life. | Before a proposal goes forward for approval |
| 1 | Business justification / business case | Tests whether the proposed approach meets the business need, is achievable within the time and resources, and applies a benefits-management approach. | After the strategic business case |
| 2 | Delivery / procurement strategy | Investigates the assumptions in the outline business case and the proposed delivery and sourcing approach. | Before going to market |
| 3 | Investment decision | Examines the full business case and governance to confirm the project is still needed, achievable and value for money. | Before contract award / funding commitment |
| 4 | Readiness for service | Checks that the organisation is ready to implement and operate what is being delivered. | Before go-live |
| 5 | Operations review / benefits realisation | Assesses whether the expected benefits are being achieved and the service is running as intended. | After the project is in service |
A note on numbering. Gate numbers are not identical everywhere, so it is worth confirming which set applies to you. The Australian Government's RMG 106 labels Gate 0 as business need and Gate 1 as business case. Queensland Treasury numbers its equivalents differently again, Gate 2 is the business case stage (its most common review), Gate 3 is contract award, Gate 4 is readiness for service and Gate 5 is benefits realisation. The logic is the same everywhere: an independent check at each point where a major decision is about to be made.
What happens during a gateway review
A review team is usually four independent reviewers, one team leader and three members, drawn from the public and private sectors and chosen for experience relevant to the gate. The review itself is short and intensive: typically around three to five days on site, depending on the jurisdiction.
The rhythm is predictable. There is normally a planning meeting one to two weeks beforehand so the team can get an overview of the project and start reading the documents. During the review the team reads the evidence pack and holds confidential, non-attributable discussions with nominated stakeholders, so people can speak frankly. The team usually meets the SRO at the start, gives a short summary at the end of each day, and presents findings, recommendations and a Red/Amber/Green rating in a draft report at the close. The report is written for the SRO and is confidential. Reviews work best when scheduled roughly four to six weeks before the real decision point, leaving time to act on what is found.
How the Red/Amber/Green rating works
The headline output is a delivery confidence assessment, a Red/Amber/Green (RAG) rating of how confident the team is that the project will be delivered successfully. (In Australia this changed in mid-2009: the traffic light used to signal how urgently findings needed addressing, and now reflects confidence in delivery.) The standard definitions are:
| Rating | What it means |
|---|---|
| Green | Successful delivery to time, cost and quality appears highly likely, with no major outstanding issues that currently threaten delivery. |
| Amber | Successful delivery appears feasible, but significant issues exist that need management attention; they look resolvable and, if addressed promptly, should not cause overruns. |
| Red | Successful delivery appears unachievable as things stand; there are major issues that do not currently look manageable, and the project may need re-baselining or a viability re-assessment. |
Intermediate ratings (Amber/Red and Amber/Green) are used for positions in between. A Red or Amber/Red rating typically triggers an escalation process, senior people and monitoring roles are informed so the project gets support to recover, and a follow-up review of the action plan usually takes place. For context on how ratings have trended over time, the Australian National Audit Office's review of the process found that after the 2009 change the share of Green reports rose to over 60 per cent.
What goes into a gateway evidence pack
Reviewers form their view from the documents you supply plus their interviews. For an investment-decision gate, a pack commonly spans the business case, the integrated schedule, the risk register, the benefits realisation plan, the governance pack and stakeholder engagement material. The pack is not read one document at a time, reviewers compare claims across documents, which is where most challenges come from. If your business case assumes a September contract award but the schedule and procurement plan say November, that inconsistency will be found.
Why packs get an Amber or Red
Studies into why major projects struggle point to a recurring set of causes, and they map closely onto what reviewers challenge:
- a weak link between the project and clear strategic priorities and success measures;
- no clear break of the work into manageable, deliverable steps;
- poor governance around scope, selection and procurement method;
- a business case that is not robust or properly reviewed;
- gaps in project and portfolio capability;
- benefits that are vaguely defined, unmeasured or unowned.
In practice, the most common failures are not missing documents but contradictions between them and benefits that are asserted but not tied to funded milestones, the kinds of issues that are easy to fix weeks out and expensive to fix in review week.
How to prepare: a readiness checklist
Use the last few weeks before a review to make the pack internally consistent and easy to follow. A practical checklist:
- Confirm the authoritative baseline. Make sure cost, schedule and scope tell one story across the business case, master schedule and risk register, and minute the decision if a baseline changed.
- Trace every benefit. For each benefit, show the owner, measure, baseline, target, the funded delivery milestone it depends on, and where it will be reported.
- Fund and own the critical risks. Check the top risks are reflected in the business case and have named owners and treatments.
- Show current stakeholder engagement. Include recent evidence of engagement with the stakeholders who matter, including central agencies.
- Map documents to the criteria. Know which document answers each criterion for your gate, so nothing looks missing.
- Read the pack as a reviewer would. Compare documents against each other, not just in isolation, and fix contradictions before document freeze.
Each of these steps is expanded, criteria first, then a document-by-document consistency check and a week-by-week timeline, in our gateway review checklist, a practical way to walk the pack through before document freeze.
See what the reviewers will see, first
The single most useful thing you can do before review week is have someone read your pack the way an independent reviewer will, across documents, against the criteria, while there is still time to fix what they find. That is exactly what Assay does: a document-based pre-review that returns the missing evidence, contradictions and weak criteria coverage in your pack, with page-level citations for every finding. It does not replace the independent review team, conduct interviews or predict the final outcome, it shows where your pack is likely to be challenged while you can still act.
You can see a sample pre-review report to understand the format, or join the early-access waitlist.
Frequently asked questions
What is a gateway review?
A short, independent peer review of a major project or programme at a key decision point. A small team not connected to the project checks the evidence and gives the SRO an honest view of how likely it is to be delivered successfully, plus recommendations.
Who has to have a gateway review in Australia?
For the Australian Government, Finance may recommend gateway for high-risk New Policy Proposals that require government approval and meet financial thresholds, broadly, procurement or infrastructure projects of $30 million or more, projects of $30 million or more with an ICT component of at least $10 million, or programmes over $50 million. States such as NSW, Victoria and Queensland run their own gateway systems and thresholds.
What do Red, Amber and Green mean?
They are delivery confidence ratings. Green means successful delivery looks highly likely; Amber means it is feasible but significant issues need attention; Red means it looks unachievable as things stand and may need re-baselining. Intermediate Amber/Red and Amber/Green ratings sit in between.
How long does a gateway review take?
The on-site review is short and intensive, usually about three to five days, with a planning meeting one to two weeks earlier. It is best scheduled around four to six weeks before the decision it supports.
Can a gateway review fail my project?
No. Gateway reviews do not pass or fail projects and cannot stop them. A Red or Amber/Red rating triggers an escalation and support process, but the SRO stays accountable and decides how to act on the recommendations.