Governance Framework

The Governance module provides a structured approach to PMO process management, project health monitoring, enterprise risk oversight, maturity assessments, and compliance calendar tracking. It ensures that transformation programs operate under a well-defined governance model with full audit traceability.

Overview

Enterprise transformation programs require consistent governance processes to maintain quality, compliance, and strategic alignment. ProBeya's Governance module centralizes all governance artifacts in a single framework that organizations can customize to match their operating model. The module covers five interconnected areas: governance frameworks with defined processes, automated project health computation, organization-level enterprise risk management, PMO maturity assessments, and a unified governance calendar that aggregates all compliance-relevant events.

Governance frameworks follow a strict lifecycle: draft (editable), active (operational, one per organization), and retired (read-only archive). This enforces the business rule that an organization operates under exactly one governance model at any given time.

Getting Started

1. Navigate to Portfolio > Governance in the sidebar.
2. Click Initialize from Template and select a governance style: PMI, Agile, or Lean.
3. Review the generated draft framework and customize processes as needed.
4. Activate the framework to make it operational. Any previously active framework is automatically retired.
5. Configure Health Rules under the Health tab to define RAG thresholds for project monitoring.
6. Set up the Enterprise Risk Register and define your organization's risk appetite.
7. Run your first Maturity Assessment to establish a baseline.

Key Concepts

Governance Frameworks

A governance framework is a versioned collection of PMO processes that define how the organization manages projects. Each process includes:

• Name and description of the governance activity
• Frequency: how often the process runs (weekly, monthly, quarterly, annually)
• Responsible: the role or individual accountable for execution
• Inputs / Outputs: what the process consumes and produces
• Tools: supporting tools and systems used during execution
• Templates: associated document templates
• Sort order: display position for drag-and-drop reordering

Health Rule Engine

Health rules define threshold-based conditions that map to RAG (Red/Amber/Green) statuses across multiple project dimensions. The engine evaluates all active rules against live project metrics and persists the results as a time-series for trend analysis.

Dimensions include schedule variance, cost performance, scope stability, risk exposure, and an overall composite score. Rules are prioritized so that when multiple rules trigger for the same dimension, the highest-priority rule determines the status.

Enterprise Risk Register

Organization-level risks span the entire enterprise and may link to one or more project-level risks. Each enterprise risk tracks:

• Probability (1-5) and Impact (1-5) on a standard 5x5 matrix
• Risk score: probability multiplied by impact (1-25)
• Risk rating: derived from the score (low 1-4, medium 5-9, high 10-15, critical 16-25)
• Category: strategic, operational, financial, compliance, reputational, technology, or market
• Mitigation strategy and contingency plan
• Review frequency and next review date
• Linked project risk IDs for traceability from project to enterprise level

Maturity Assessments

PMO maturity assessments track organizational capability across configurable dimensions using standard models (CMMI, P3M3, OPM3) or custom models. Each assessment records dimension-level scores with evidence and target levels, and the system automatically computes the overall maturity level as the arithmetic mean.

Governance Calendar

The governance calendar aggregates events from five sources into a unified chronological view: gate reviews, compliance assessments, risk reviews, PMO process schedules, and report deadlines. Events are classified as upcoming, completed, or overdue.

How It Works

Framework Lifecycle

Frameworks follow a strict state machine: draft → active → retired. No backward transitions are allowed. When a framework is activated, any currently active framework is automatically retired. This ensures organizational clarity about which governance model is in effect.

Processes can only be removed from draft frameworks. Active and retired frameworks are immutable to preserve the governance audit trail. To modify an active framework, create a new draft version with the desired changes, then activate it.

Template Initialization

The Initialize from Template action creates a draft framework pre-populated with processes from a built-in template. Three templates are available:

• PMI: Traditional PMI-aligned governance with portfolio reviews, change control boards, and earned value reporting
• Agile: Lightweight governance with sprint reviews, retrospectives, and continuous delivery checkpoints
• Lean: Value-stream-focused governance with gemba walks, A3 reviews, and kaizen cycles

Health Computation

Health computation can be triggered in two ways:

• Single project: Click "Refresh Health" on a project detail page to evaluate all health rules for that project
• Batch refresh: Click "Refresh All" on the portfolio dashboard, or schedule a nightly cron job that evaluates all active projects

The engine evaluates each dimension by checking rules in priority order. The first rule whose condition matches determines the dimension's status. Results are persisted to the health history table for trend charting.

Default health rules can be seeded via the Load Defaults button. This is idempotent and will not overwrite existing rules.

Risk Heatmap and Rollup

The Risk Heatmap displays a 5x5 probability-impact matrix with counts of enterprise risks in each cell. Only non-closed risks are included. The heatmap provides an at-a-glance view of the organization's risk landscape.

The Rollup Project Risks action scans all active project-level risks and automatically creates enterprise risk entries for any project risk with a score above a configurable threshold (default: 10, corresponding to "high"). Existing links are checked to avoid duplicates.

Risk Appetite Configuration

The Risk Appetite settings define organization-specific thresholds for how risk scores map to ratings and what risk levels are acceptable per category. This is an upsert operation: each organization has exactly one appetite record.

Maturity Trend and Improvement Roadmap

The maturity trend view shows all assessments as a time-series chart, plotting overall level and per-dimension levels over time. This reveals whether the organization is improving, stagnating, or regressing.

The Improvement Roadmap analyzes the gap between current and target levels in a specific assessment and generates prioritized action items. Gaps of 3+ levels are flagged as critical, 2 levels as high, and 1 level as medium. Model-specific suggestions guide step-by-step progression.

Governance Reports

A catalog of governance reports can be generated on demand:

• Framework compliance: current framework status and process adherence
• Health trend: project health evolution over time
• Enterprise risk summary: risk register with heatmap data
• Maturity dashboard: latest assessment with radar chart data
• Lessons learned: knowledge base summary (see Lessons Learned)
• Change control: audit trail of governance changes

Reports accept optional date ranges for time-bounded analysis and return structured JSON suitable for PDF/Excel export.

Configuration

Setting	Location	Description
Framework template	Governance > Init from Template	PMI, Agile, or Lean starting point
Health rules	Governance > Health Rules tab	Threshold conditions per dimension
Default health rules	Health Rules > Load Defaults	Seed standard rules for all dimensions
Risk appetite	Risk Register > Appetite Settings	Organization-specific risk thresholds
Maturity model	Assessments > New Assessment	CMMI, P3M3, OPM3, or Custom
Report catalog	Governance > Reports tab	Available report types and date ranges

Permissions

• View governance: all organization members can view frameworks, health data, and reports
• Create/edit frameworks: requires PPM admin or governance manager role
• Activate/retire frameworks: requires PPM admin role (irreversible state transitions)
• Manage health rules: requires PPM admin or governance manager role
• Manage enterprise risks: all project managers can create; risk owners can edit their own
• Run maturity assessments: requires PMO lead or governance manager role
• Generate reports: all organization members with PPM access

Tips & Best Practices

• Start from a template: Even if your governance model is highly customized, starting from a template and modifying is faster than building from scratch.
• Keep one active framework: The system enforces this, but plan your framework transitions carefully. Retiring a framework is permanent.
• Seed health rules early: Default health rules provide immediate value. Customize thresholds after collecting a few weeks of health data.
• Review risk appetite quarterly: As the portfolio evolves, risk tolerance may shift. Update appetite settings during quarterly governance reviews.
• Use the rollup threshold wisely: Setting the rollup threshold too low (e.g., 5) will flood the enterprise register with medium risks. The default of 10 captures high and critical risks.
• Run maturity assessments periodically: Quarterly assessments provide enough data points for meaningful trend analysis without assessment fatigue.

Troubleshooting

Issue	Cause	Resolution
Cannot activate framework	Framework is not in draft status	Only draft frameworks can be activated. Check the current status.
Cannot remove process	Parent framework is active or retired	Processes can only be removed from draft frameworks.
Health computation returns no data	No active health rules defined	Seed default rules or create custom rules for each dimension.
Risk rollup creates no entries	All high-scoring project risks already linked	Check the enterprise register for existing linked entries.
Maturity trend chart is empty	No assessments have been created yet	Run your first assessment to establish a baseline.
Governance calendar shows no events	No gate reviews, risk reviews, or processes scheduled	Ensure active governance processes have scheduled dates.

Related Features

• Stage-Gate Reviews -- Gate reviews appear on the governance calendar
• Risk Management -- Project-level risks roll up to enterprise risks
• Earned Value Management -- EVM metrics feed health rule evaluations
• Lessons Learned -- Lessons learned reports are part of the governance reporting suite
• Financial Reports -- Financial data supports governance decision-making