Operational Excellence in Project Management

• Replace structural thinking with service-oriented thinking

Influence is not a characteristic of the PMO. It is the result of the services the PMO delivers.

The PMO-MI Model model is direct:

Impact is not in the existence of the PMO, but in how its services operate and connect.

This changes the core question.

Instead of asking:

“What is the role of the PMO?”

The question becomes:

“Which services actually interfere with relevant decisions?”

Without this shift, the PMO continues trying to gain relevance through internal structure.

And that does not change outcomes.

• Reposition services into the correct domains

Not every service needs to influence decisions. However, critical services must be positioned where decisions are made.

The model establishes that impact occurs in the domains of control and influence, not within observation.

This requires a clear distinction:

• services that remain in the domain of concern continue to be informational
• services positioned in the domain of influence begin shaping decisions

Without this distinction, the PMO increases operational activity without increasing organizational relevance.

• 
  
• Integrate capabilities to generate organizational effect

Isolated capability does not create influence.

Impact is not the result of adding practices together.

It emerges from the integration between services and domains.

This is the most neglected point.

PMOs improve processes, tools, and controls.

But they fail to integrate capabilities in ways that alter how the organizational system operates.

The result is predictable:

• Consistent execution with no meaningful organizational change.
• Influence requires something different.

The capability to connect information, anticipate implications, and act before decisions become fixed.

Without this, the PMO reacts instead of directing.

Repositioning the PMO is not about evolving practices. It is about changing how the organization makes decisions.
When this happens, the evaluation criteria change.
The PMO stops being measured by what it controls and starts being recognized by what it changes.

Without this movement, any evolution tends to reinforce the current pattern:

• more internal capability with the same absence of influence.

• Risks continue to be absorbed too late
• Priorities continue to be redefined outside the PMO
• Decisions continue to happen without structured input

None of this shows up in internal assessments.

Because they measure consistency, not influence.

This is the breaking point.

A PMO can continuously evolve while simultaneously losing strategic relevance. When that happens, the nature of the discussion changes.
It is no longer about quality.
It becomes about necessity.

The PMO is not questioned for what it does. It is questioned for not making a difference.
From that point onward, any additional evolution tends to generate diminishing returns.
More process.
More control.
The same irrelevance.
The required shift is not technical.
It is structural.

As long as the PMO continues to operate as a mechanism for organizing execution, it will remain outside the decision core.
And outside the decision core, there is no perceived value.
In the next pieces, I will explore three points that are usually left out of this discussion:

• How to reposition the PMO to generate real influence,
• How to measure impact practically, and
• How to connect PMO services to executive decision-making.

Introduction

The Nature of Cyber Risk in Projects

• Interdependence: vulnerabilities in one system may propagate across integrated platforms
• Latency: risks often remain undetected until late phases of execution
• Impact asymmetry: relatively small vulnerabilities can generate disproportionate operational or financial consequences

• operational continuity
• regulatory compliance
• organizational reputation
• physical safety (particularly in OT environments)

Integrating Cybersecurity into Project Management

• Definition of security requirements aligned with business and regulatory expectations
• Identification of critical assets and threat vectors
• Integration of security criteria into scope and acceptance definitions

• Continuous validation of security controls
• Coordination between technical teams, vendors, and governance structures
• Monitoring of vulnerabilities introduced during implementation

• Use of specific cybersecurity KPIs, such as:
• percentage of implemented security requirements
• number of critical vulnerabilities resolved within SLA
• incident response time during testing phases
• Alignment with frameworks such as ISO/IEC 27001 and NIST CSF

• Validation of compliance and certification requirements
• Documentation of lessons learned related to security incidents and controls

The Role of the Project Manager

• facilitating alignment between business, technical, and regulatory stakeholders
• ensuring traceability between security requirements and implementation outcomes
• supporting decision-making under uncertainty, particularly in risk prioritization

Common Implementation Challenges

• Fragmentation of responsibilities between IT, security, and business units
• Late inclusion of security requirements, increasing rework and costs
• Limited visibility of cyber risks at the portfolio level
• Difficulty in measuring the real impact of security initiatives

Practical Application: What Should Change in Project Execution

• Embed security checkpoints in stage-gate or agile review cycles
• Define minimum security baselines for all project types
• Establish clear ownership of cybersecurity risks within the project structure
• Integrate security metrics into project dashboards and reporting routines
• Use risk-based prioritization to balance delivery speed and protection requirements

Conclusion

• adjust the methodology
• reinforce governance
• add more controls

• decisions being made outside the PMO
• low adherence to practices
• conflicts with business areas
• questioning of the PMO’s value

“we need to reinforce governance”

But the PMO already controls processes well.

That is not where the problem is.

The problem is that relevant decisions are happening in a different space, where the PMO is not present.

In other words, it is not a process failure.

It is a positioning failure.

Where is the mistake

Most PMOs evolve by deepening control.

Few are able to expand influence.

And it is in this gap that hotspots emerge.

The PMO improves what it controls, but decisions remain outside its reach.

Result:

• more effort
• more structure
• the same perception of value

The real issue is different:

clearly understanding where the PMO actually operates

and where it should operate, but cannot

Without this clarity, any improvement tends to happen in the wrong place.

As a result, the PMO may evolve internally, but still struggle to demonstrate real impact.

This pattern is not isolated.

There is evidence that many organizations are mature in delivery, but still far from achieving effective business outcomes.

To reflect

If in your context there are:

• decisions happening outside the PMO
• low adherence to practices
• a constant need to reinforce governance

It begins to operate along two distinct dimensions.

• The first dimension remains the leadership of the project team. This is the more traditional dimension and involves creating cohesion within the team, resolving conflicts, aligning expectations, and ensuring collaboration among specialists.
• The second dimension involves the organizational leadership of the initiative. Here the professional must operate within a broader space that includes executives, functional departments, governance structures, and often the strategic portfolio of the organization.

• Horizontal leadership refers to the ability to mobilize people and coordinate efforts across project stakeholders.
• Vertical leadership refers to the ability to connect the project to organizational strategy and influence decisions that affect its direction and impact.

Are we training professionals who are capable only of managing schedules, or leaders capable of guiding initiatives that truly transform organizations?

This reflection is particularly important at a time when projects have become the primary mechanism through which many organizations implement their strategies. The greater the complexity of these initiatives, the more central project leadership becomes as a core professional capability.

References

• PMI – Project Management Institute. A Guide to the Project Management Body of Knowledge (PMBOK Guide). Seventh Edition. Newtown Square: PMI, 2021.
• IPMA – International Project Management Association. Individual Competence Baseline Version 4.0. Zurich: IPMA, 2015.
• Joslin, Robert; Müller, Ralf. Relationships between a project management methodology and project success in different project governance contexts. International Journal of Project Management, v. 33, n. 6, 2015.
• Joslin, Robert. Addressing Portfolio Information Issues through the Use of Business Social Networks, Stars and Gatekeepers. International Journal of Project Management, 2015.