The evidence on major infrastructure points the same way every time: the damage is done early. Commitments are made before enough evidence exists to justify them, and by the time the overrun surfaces in a quarterly report, the decision that caused it is years old and locked in.
16 questions. Five decision dimensions. Results shown immediately.
Bent Flyvbjerg's project database at Oxford now covers more than 16,000 projects across 136 countries. Fewer than one in ten comes in on budget and on time. One in two hundred delivers on budget, on time and with the promised benefits. He calls it the iron law of megaprojects: over budget, over time, under benefits, over and over again.
A pattern that consistent is structural. Projects are announced, funded, scoped and taken to market before the problem, the alternatives, the benefits case and the capacity to deliver have been tested. Once commitment hardens, the original decision becomes practically impossible to revisit, whatever evidence turns up later.
The Iron Law Risk Assessment tests whether a project or programme shows the structural conditions that precede this sequence, before the cost, schedule or audit exposure arrives.
Post-completion reviews keep finding the same sequence. Scale, sector and delivery model make surprisingly little difference.
The preferred solution is chosen before the problem is defined. Alternatives appear in the business case, but they were never seriously in the running.
Benefits are asserted, not measured. No owner, no baseline, and nobody tasked with checking whether they ever arrive.
Cost and schedule outcomes from comparable completed projects are set aside as not really comparable, and the budget is built from internal judgement instead.
Market capacity is assumed. Nobody asks whether three other projects are chasing the same contractors, labour and materials over the same years.
The public announcement lands before the major uncertainties are resolved. From that point the governance system has no realistic way to pause or stop the project.
The one assumption the whole business case stands on is never independently tested. If it is wrong, everything built on it is wrong, and the window for finding out has already closed.
The iron law is a critique of decision systems. Organisations become very good at approving projects while staying bad at asking whether a project was ready to be approved.
Gateway and assurance reviews mostly arrive after commitment has hardened. Business cases are written to justify decisions already made. Risk registers record optimism bias and do nothing about it. Momentum, political, executive and financial, carries the rest.
The Iron Law Risk Assessment asks a different question. Not whether the project can be delivered, but whether the evidence existed to justify committing to it in the first place.
Each dimension reflects a category of evidence that a responsible commitment requires. The questions test what actually happened, not what the process manual says should have happened.
Was the problem defined and tested before a solution was picked? Were at least two credible alternatives assessed on the same evidence standard, and could the decision-makers say why the winner won?
Were measurable outcomes defined before the public commitment was made? Is there a documented process for checking that benefits actually arrive, and was the project ever weighed against other uses of the same money?
How many comparable completed projects were examined before approval? Whether their actual cost and schedule record formally informed this budget and timeline, or was quietly ignored.
Whether market capacity has been tested rather than assumed. Concurrent projects competing for the same labour, materials and contractors, and an independent view of the client's own capability to deliver.
If evidence emerged tomorrow that the key assumption is wrong, could this project realistically be paused, redesigned or stopped? Knowing what you know now, would it still be approved?
A Critical Assumption Check sits in front of the scored assessment. If the single assumption the benefits case depends on has never been independently tested, a Critical Assumption Alert appears in your results regardless of the overall score.
The assessment does not presume the commitment was premature. It tests the decision against the evidence that was available at the time.
The evidence, alternatives and governance conditions were in place before commitment. Pre-commitment governance stands up to scrutiny.
The foundations are there. Specific gaps need a documented rationale, recorded with their implications.
The available evidence does not yet support responsible commitment. Named dimensions remain open and warrant attention before obligations are finalised.
The structural conditions a commitment of this size requires were not in place when it was made. Independent review is recommended before further obligations are extended.
A Governance Risk Identified finding says nothing about the people involved. It records where the decision structure fell short of the size of the commitment. That is the assessment doing its job.
Scored separately from the main assessment. It tests whether the single assumption the benefits case depends on was identified and independently tested before commitment. Answer for the decision as it actually happened.
Problem definition, outcomes, reference-class evidence, delivery capability and decision closure. Four-point scale. About four minutes.
Name, organisation, role and work email. Scored results display immediately, with a written summary of where governance risk enters. Submissions come to Shayne Whitehouse at UrbanTech Plus and are not shared or distributed beyond that point.
The issue that scores worst is not always the one doing the damage, and the same decision weakness tends to surface in several places at once. Working out what the results mean inside your project, and what options remain open, is a conversation.
Research spanning thousands of completed infrastructure projects shows that overruns are the norm, not the exception. The Iron Law Risk Assessment is grounded in that evidence base and calibrated for Australian infrastructure.
Major projects run over budget, over time or both
Delivered on budget, on time and with the promised benefits
Where most of the cost and schedule outcome is locked in
Source: Flyvbjerg et al., Oxford global project database of 16,000+ projects across 136 countries. The assessment also carries benchmark data from seven major Australian infrastructure projects as scored reference points.
The assessment is built for decision-makers approaching a major commitment, or answerable for one already made.
- Chief Executives and Directors-General in infrastructure-owning organisations
- CFOs testing business case quality before budget approval
- Infrastructure and asset executives running capital programmes
- Strategy and portfolio executives accountable for investment decision quality
- Audit and risk committee members reviewing assurance over major projects
- Treasury and finance officials assessing funding submissions
- Tier 1 and Tier 2 contractors weighing client decision quality before bidding
- Independent advisers commissioned to assess governance over existing commitments
The Iron Law Risk Assessment examines the quality of evidence and governance at the point of commitment. It does not review delivery performance, recommend termination, or stand in for technical due diligence.
There is also a professional reason to run it. Every major commitment carries exposure for the executives who made it and the advisers who supported it. A completed assessment is a record that the decision was tested against the available evidence, whatever the finding turns out to be.
UrbanTech Plus is neutral on the project itself. The assessment exists to test whether the evidence for commitment existed before the decision was made.
Four minutes, scored results immediately. If the findings need interpreting, Shayne is available to work through them in the context of your project or programme.
Not ready to run it? Start a confidential conversation.
Shayne Whitehouse | AU +61 411 261 161
A project starts to slow down.
Approvals take longer. Costs begin to escalate. Decisions stall, get revisited, or move forward without full visibility.
Teams respond the only way they can — more resources, new systems, tighter controls.
But nothing materially improves.
Because the issue was never in delivery.
The constraints were already built into the way decisions were structured.
In infrastructure projects, that structure defines how decisions are made — the sequence, the authority, and the evidence required before commitment.
When that structure is flawed, cost escalation and delay are not unexpected — they are built in from the start.
Every additional investment — technology, people, process — compounds the problem instead of solving it, locking in more cost, more delay, and more delivery risk.
Structured to fit within standard delegation frameworks — no procurement process required for initial diagnostic