Project governance and portfolio management in government digitalization

Abstract

Purpose

This paper aims to increase the current understanding of the connection between operational level information and communication technology (ICT) projects and national level digital transformation by researching how project governance structures and practices are applied in an e-government context.

Design/methodology/approach

An elaborative qualitative study through public documentary analysis and empirical multi-case research on Finnish central government is used.

Findings

The study constructs a multi-level governance structure with three main functions and applies this in an empirical setting. The results also describe how different governance practices and processes, focusing on project portfolio management, are applied vertically across different organizational levels to connect the ICT projects with the national digitalization strategy.

Originality/value

This study integrates project governance and portfolio management knowledge into public sector digitalization, thus contributing to project management, e-government and ICT research streams by improving the current understanding on the governance of ICT projects as part of a larger-scale digitalization. This study also highlights perceived gaps between current governance practices and provides implications to managers and practitioners working in the field to address these gaps.

Citation

Lappi, T.M., Aaltonen, K. and Kujala, J. (2019), "Project governance and portfolio management in government digitalization", Transforming Government: People, Process and Policy, Vol. 13 No. 2, pp. 159-196. https://doi.org/10.1108/TG-11-2018-0068

1. Introduction

Digital transformation, or digitalization, is one of the global megatrends that drive private – and public sector – organizations’ reforms through the adoption of information and communication technology (ICT) solutions to optimize operations and provide better services to customers – or citizens. Digitalization challenges institutions’ and individuals’ technological, organizational and cultural mindsets and capabilities, which can be a struggle especially in the public sector, as governments have to also cope with legal, political and public accountability-related issues while aiming towards national level digitalization, or “e-government” (Cordella and Tempini, 2015). However, understanding of the impact of processes behind this reformation connecting different government levels – the strategic governance level (e.g. government, parliament), the middle executive level (e.g. ministries, agencies) and the operational (ICT project) level – is limited. Hence, more exploratory, empirical research is called for (Snead and Wright, 2014). Even though Finland has been recognized internationally as one of the most advanced e-government countries (OECD, 2015), the ICT development projects keep struggling also in Finland. These struggles are due to complexities and uncertainties in related issues, such as governance, organizing and technology (Omar et al., 2017; Walser, 2013).

Public sector digitalization, like any strategic transformation process, is executed eventually through ICT projects (Anthopoulos and Fitsilis, 2014; McElroy, 1996), ranging from a simple agency-specific online portal to vast, multi-organizational operations management systems. In both digitalization and ICT project perspectives, it is essential to connect the projects with digitalization strategy by ensuring that the project objectives are correctly aimed and properly conducted. In other words, one must ensure that digitalization and associated ICT projects are governed appropriately (Crawford and Helm, 2009; Marnewick and Labuschagne, 2011). One technique to govern projects is project portfolio management (PPM) – a mechanism that on the management level consolidates a group of projects into one entity to ensure the strategic contribution and fit of the projects and maximize the value of the whole portfolio (Kaiser et al., 2015; Meskendahl, 2010; Müller, 2009). Though there have been some contextual studies on PPM application in regional governments level (Hansen and Kræmmergaard, 2013; Nielsen and Pedersen, 2014), knowledge of the topic in e-government context is still limited. Furthermore, the vertical processes between different central or state government levels, and how PPM can be applied to facilitate these processes and the governance of ICT projects, must be researched (Jenner, 2010; Snead and Wright, 2014). The Finnish Ministry of Finance (VM) introduced PPM in 2012 to consolidate central government ICT projects, but its impact and utilization have not been analyzed properly, further empirically motivating this study.

This study aims to improve understanding of the connection between operational level ICT projects performed by government agencies and the national level digital transformation by researching how project governance structures and practices, especially PPM, are applied in an e-government setting. Through explorative public documentary analysis and empirical multi-case research on Finnish central government, this study describes the governance structure for digitalization and ICT projects and analyzes how different practices and processes, namely, PPM, are applied vertically across different levels to facilitate project governance. To better achieve this purpose, two explicit research questions (RQ) were formed:

RQ1.

What kind of governance structure is applied to ICT projects in public sector digitalization?

RQ2.

How can PPM facilitate the governance of ICT projects vertically across different levels?

This study integrates project governance and portfolio management knowledge into public sector digitalization context, thus contributing to project management, e-government and ICT research by improving understanding of the governance of ICT projects as part of a larger scale digitalization. By describing and analyzing practices related to the governance of ICT projects, this study provides implications for managers and practitioners working in the field. This paper includes a review of applicable literature on e-government, governance and PPM, followed by the research and methodology of this study and the results and discussion, with suggestions for further research.

2. Theoretical background

2.1 Public sector digitalization and e-government

Public administrations across the world have been striving towards digitalization, enabled by rapidly evolving technology and motivated by cost-efficiency and quality. This transformation mostly centers around developing and applying digital solutions to streamline internal and external processes and providing better services for citizens (Asgarkhani, 2005; Fishenden and Thompson, 2013; Janowski, 2015). However, to fully use the potential of digital solutions and services, public sector strategies, structures and organizations need to reform accordingly to support renewed solutions and services. This combination has been commonly referred to as e-government (Layne and Lee, 2001; Lee, 2010), and it is achieved through a transformation process that consists of phases from strategy formation to project execution (Anthopoulos and Fitsilis, 2014; Pedersen, 2018). E-government has strong citizen value and collaboration perspectives, thus sharing common ground with preceding public reformation initiatives, such as the market-lead New Public Management (NPM) (Arnaboldi et al., 2004) or coordination encouraging Joined-up Government (Cordella and Bonina, 2012). Though the etymology of “e-government” has somewhat suffered from inflation and been complemented with more generic and ambiguous terms, e-government is still widely used to assess the maturity of ongoing digitalization and to benchmark and provide guidelines for future efforts (OECD, 2015; Rorissa et al., 2011; Valdés et al., 2011). The purpose of e-government or public sector digitalization is not only to provide information and services to citizens but also to create strategic connections internally and externally between government layers and agencies, enterprises and citizens. However, digitalization is challenging in many ways (Pedersen, 2018) and may cause resistance, as it requires significant organizational and technological adjustments, such as architecture adoption (Irani, 2005). The primary reasons for e-government struggles include ambiguous mission statements and poor project management (scope, schedule, stakeholders) causing, for example, resource overuse, longer time to market and unmet client expectations, but there are also governance-related remedies to counter these challenges (Altameem et al., 2006; Kathuria et al., 2007).

2.2 Project governance

Governance is a function of management for establishing policies to oversee the work – and ensure the viability – of an organization. It is a rather ambiguous term that has been perhaps most efficiently defined by McGrath and Whitty in their review article from 2015 as follows: “the system by which an entity is directed and controlled” (p. 774).

Furthermore, from organizational perspective, governance defines the structures used by the organization, allocating rights and responsibilities within those structures, and requiring assurance that management is operating effectively and properly within the defined structures (Too and Weaver, 2013). Governance takes place on different levels of an organization that are most commonly divided into three (Loorbach, 2010; Kathuria et al., 2007; Too and Weaver, 2013): the highest level – the strategic, corporate or board of directors and governance system; the middle level – tactical, business or executive and management system; and the lowest level of functional, or operational project delivery system activities. A governance structure is essentially a framework describing the functional roles and responsibilities of these levels within an organizational system, while also identifying the links between them needed for effective and efficient execution (Müller, 2009).

Project governance exists within the corporate governance framework and comprises the value system, responsibilities, processes and policies that allow projects to achieve organizational objectives and foster implementation beneficial to stakeholders and the organization itself (Müller, 2009; Turner, 2006). However, the temporary nature of project organizations separates the governance of project organization from that of a permanent organization (Lundin et al., 1995; McGrath and Whitty, 2015). Project governance is a multidimensional concept: it takes place in all levels within an organization by shifting the scope and objectives between (Biesenthal and Wilden, 2014; Brunet, 2018), outside the organization and project through stakeholders and networks (DeFillippi and Sydow, 2016; Ruuska et al., 2011; Winch, 2014), and also a process with the project life cycle (Samset and Volden, 2016; Sanderson, 2012; Stewart, 2008). Project governance creates a decision-making framework for project organizations to execute projects (Joslin and Müller, 2016a; Oakes, 2008). In other words, to ensure that organizations efficiently “Do the projects right.” Besides the how, another important aspect governance of projects is the what, i.e. to ensure that organizations effectively “Do the right projects” (McGrath and Whitty, 2015; Müller, 2009). To assure that a project contributes to an organization’s strategic objectives, one must constantly align, revise and communicate long-term and short-term project goals and use motivation and control to make performances comply with goals (Hrebiniak and Joyce, 1984; Srivannaboon and Milosevic, 2006).

2.3 Project portfolio management

PPM is a project management technique used to align and control a group of projects according to the objectives and benefits of an organization. There are three central objectives for PPM: strategic alignment (ensure strategic direction of projects); balancing across projects (in terms of strategically important parameters, such as resources or risks); and value maximization (in terms of company objectives) (Martinsuo and Lehtonen, 2007; Petro and Gardiner, 2015). Meskendahl (2010) complements these objectives by adding the use of synergies (reduce double work and enhance utilization regarding technologies, marketing, knowledge and resources) to the list. In practice, the managerial activities related to PPM are the initial screening, evaluation and prioritization of project proposals; the concurrent evaluation and reprioritization of individual projects; and the allocation and reallocation of shared resources (Blichfeldt and Eskerod, 2008; Jonas, 2010). These managerial practices are conducted through decisions by portfolio owners and managers at certain process gates or portfolio management board meetings and must balance a multitude of conflicting goals within an organization. PPM therefore attempts to answer project-related questions such as: “What should we take on? What should be terminated? What is possible? What is needed (Dye and Pennypacker, 1999)?”

With regard to ICT projects, the technological alignment through enterprise architecture and standardized processes and software tools can be applied to PPM (de Reyck et al., 2005). However, in the public sector, both ICT PPM and project performance can be diminished with rigid decision-making processes, excess requirements of conformity, communication issues and strong organizational regulations (Mosavi, 2014; Walser, 2013). These political aspects, if integrated into existing decision-making and corporate management practices to avoid excess bureaucracy, can be reversed to strengthen PPM (Martinsuo and Dietrich, 2002). For example, ICT PPM has been important in managing organizational efforts to digitalize local governments (Hansen and Kræmmergaard, 2013), but in general the trade-off between centralization of power and project autonomy can be considered a prevailing and central challenge in the application of PPM in public sector ICT projects (Kaiser et al., 2015).

2.4 Synthesis: analysis framework

To synthesize the reviewed literature, an analysis framework based on the research questions was constructed. Project governance consists of the practices that take place through functions within different levels of organizations. The term “practices” encompasses all the different activities, procedures and processes that are applied to align, control and safe-guard the ICT project objectives and performance for the value and strategic targets of the organization. Hence, the first part of the framework builds vertically on the multi-level governance structures (Too and Weaver, 2013; Kathuria et al., 2007; Loorbach, 2010) and includes the three organizational levels: strategic (the highest), executive (middle management) and operational (project) with distinguished responsibilities and performance scopes. Horizontally the framework consists of the e-government and project governance-related functions (Anthopoulos and Fitsilis, 2014; Irani, 2005) to describe and categorize the types of project governance practices and their subsequent objectives. As the focus of this research is on the application of PPM as a mechanism that connects the ICT projects with the higher level objectives by alignment and assurance, the second part of results describes in more detail the PPM specific goal alignment and performance compliance practices (Müller, 2009; Kaiser et al., 2015; Blichfeldt and Eskerod, 2008) that can be associated with the “requiring assurance” function – or vertical alignment (Hrebiniak and Joyce, 1984) of project governance. Even though PPM does have additional purposes and objectives such as balancing and value maximization, these are not included in the analysis framework as the purpose is not to explore the overall utilization of PPM in e-government.

3. Research process

3.1 Research approach and empirical settings

A qualitative research strategy built upon gaining an in-depth understanding of the unique empirical setting was considered most suitable for this study (Sarker et al., 2013; Yin, 2013). As studies on PPM and governance in specific contexts have been requested (de Haes and van Grembergen, 2009; Müller et al., 2008), this research applies an inductive, multi-case method to explore and elaborate (Eisenhardt, 1989; Ketokivi and Choi, 2014; Yin, 2013) the practices associated with the governance of ICT projects, and how they are perceived vertically on and between different government levels, in this case, public sector digitalization (Snead and Wright, 2014). The framework presented in Figure 1 was used in the inductive analysis. The purpose of this study was not to test the completeness of the proposed framework but to use it as a guide to synchronize the analysis and interpretation of the empirical data among researchers, and as a lens through which the elaboration and refining of the findings with the selected theoretical approaches were processed (Ketokivi and Choi, 2014).

The digitalization of the Finnish public sector is observed through publicly available documentation and four case organizations and projects, described in detail below. The context and setting can provide many research opportunities; therefore, to improve the scope and contribution, some limitations have been made. The study does not focus on the, admittedly important, formation, content or consensus of digitalization strategy (Bowman and Ambrosini, 1997), the horizontal alignment between organizations (Kathuria et al., 2007), or the alignment between ICT and business functions within organizations (de Haes and van Grembergen, 2009; Papp, 1999) and is empirically limited to the central government, as depicted in Figure 2.

Since the 1980s, Finland has, through the introduction of everyday digital solutions such as mobile phones, steadily driven toward digitalization, led by the VM. Recently, as with many other nations and public administrations, digitalization is characterized by global phenomena, such as artificial intelligence, data security, availability and analytics and virtual reality. The digitalization of the Finnish public sector has focused on providing customer-centric electronic services and establishing platforms and infrastructures, such as national service architecture. Though Finland has managed to perform well in international comparisons of digitalization and e-government (Vainio et al., 2017), there has also been criticism from external parties about the governance, efficiency, and strategy of the digitalization (OECD, 2015). VM introduced PPM in 2012 to consolidate and align ongoing and coming ICT projects, but its utilization and application are still ambiguous.

The four cases selected for research:

1. VM’s Public ICT Department (JulkICT), as the main governance authority of Finnish public sector digitalization, represents the strategic and executive levels. Under VM, the national architecture program (KaPA) was selected to represent the operational level.

2. VM’s tax administration (VERO) is responsible for the assessment and collection of taxes for individuals and corporations and providing guidance and service in associated matters. From VERO, a product-based implementation project was selected to represent the executive and operational levels.

3. The Ministry of Agriculture and Forestry’s National Land Survey of Finland (MML), is responsible for map data material and land surveying, including parceling and reallocating land. MML safeguards land ownership and credit-granting systems by maintaining information. MML has conducted two agile development projects, aiming to digitalize real-time map information utilization, included in the research for executive and operational level insight.

4. The Finnish Transportation Agency (LIVI), under the Ministry of Transportation and Communications, is responsible for roads, railways, waterways, and the development of the Finnish transport system. LIVI started its first known ICT alliance project in 2016, which was selected to represent the executive and operational levels.

The cases were chosen to provide the most heterogeneous perspective on the project level possible. The availability of data and support material, and the timeliness of the cases – especially the LIVI case – were also considered. Additional information about other organizations, projects and programs was provided through public documentation, such as national audit committee reports examining the governance practices in different ministries (e.g. the Ministry of Labor and Economy), and in selected programs and projects.

3.2 Data acquisition and analysis

The acquired data consists of three main categories: case-specific empirical data collected by the authors (RQ1, RQ2); public documentation related directly to digitalization, governance and projects (RQ1); public documentation indirectly related to the topic (RQ1). Supporting the qualitative research agenda, eleven semi-structured interviews with open-ended questions were conducted between 2015 and 2017 to provide in-depth descriptive input from respondents. The respondents were carefully selected from each case due to their knowledge and competence on the subject matter as they were either owners of or key stakeholders in their respective projects. The respondents also held senior managerial or specialist positions in different levels of their organizations, thus supporting the level-based dichotomy applied in this study. Further information could have been acquired by interviewing also the managing executives, team members, or other project stakeholders, but as the additional material provided already extensive amount of objective, supporting data, this was not seen mandatory. The interviews focused on the practices within the organization, projects associated with the governance of digitalization and ICT projects and the use of PPM. The interviews were documented and accompanied by rich supporting material from the interviewees. The interview documents were examined between researchers to interpret the findings and to reduce personal biases. The first category of public documentation consisted of laws, decrees, instructions, manuals, guidelines and tools and templates directly associated with digitalization and ICT projects. The second category included different reports, reviews and benchmarking guidelines providing insight into the topic. Over 1,500 pages of public documentation were acquired from public administration websites and other public data repositories. The details of the research data are provided in Appendix.

The data analysis began with thoroughly reading the materials and constructing rough case descriptions with interesting findings and themes. Then the raw data were imported and categorized in NVivo software. The coding criteria and interpretation rules for the project governance practices were drawn from the analysis framework, initially reviewed and agreed upon, and updated throughout the process among the researchers. The governance structure analysis (RQ1) was conducted in two parts: public documentation (Categories 2 and 3 in Appendix), and empirical case documents (Category 1) to provide rich, within-case insights. Both datasets were analyzed in two phases. First, the evidence of practices was reviewed and coded against the theoretical lens to determine the appropriate governance function. In the second phase, the applicable organizational levels of the coded practices were determined. Finally, the results of the coded findings were iterated among researchers to construct aggregated practices per organizational level under each framework dimension. A similar process was then applied for PPM practices (RQ2) in different organizational levels in the empirical cases and PPM-related public documentation (Category 1 and 2).

The findings – the project governance structure (RQ1) and PPM-related assurance practices (RQ2) – are presented in the Section 4, complemented by within and cross-case analyses. Evidence supporting the reliability of the research, presented in the accompanying tables, refers to data in Appendix by stating the category and index; for example, [2.1] refers to the first item in Category 2 (“Act on Information Management Governance in Public Administration”).

4. Results

As the research aim and questions imply, the results describe the perceived governance structure and PPM practices in two respective sections. The governance subsection explores and aggregates the digitalization and project governance practices, as shown in Tables I and II. The elaboration of the found practices is conducted according to the earlier introduced theoretical lens (Figure 1), and it elaborates the perceived commonalities, peculiarities and gaps within and between governance functions and different organizational levels. Similarly, the following PPM analysis explores and aggregates the findings on PPM practices related to assurance from the empirical cases and public documents, as seen in Table III.

The most interesting finding is evidence in the public documents on the “should be” practices, such as laws, regulations, decrees and instructions, and an equal amount of evidence, coming mostly from the empirical cases, on the “are not” – practices that are not in place or have failed, such as audit reports pointing out the lack of control or structural complexities. This discrepancy somewhat restricted the analysis of what actually takes place and the possibility of drawing explicit implications on how practices affect governance. Hence, it would have been almost tempting to deduce propositions through negative assertions (Johnson-Laird, 1999), but a critically realistic inductive analysis was still applied.

4.1 Governance structure of information and communication technology projects in digitalization

The primary objectives for public sector digilization in Finland are set through government agendas and high-level proclamations about general principles. These goals were not well connected to levels below, as all administrative sectors (ministries and the agencies under them) should create their own strategies, which they have already been doing for some time. The most concrete objective mentioned in the digitalization guidelines is “to ensure that digital services are prioritized”, which is difficult to measure. The same document also emphasizes the characteristic difference between governing digitalization and public sector administration. The former requires a cross-administrative, process-oriented approach to meet the central purpose of providing better services to citizens more efficiently, whereas the latter is based on regulatory, organizational and financial procedures that are limited by hierarchal and jurisdictive settings.

As Table I suggests, laws are considered central governance mechanisms, especially in Finland (where obedience is a considered a national virtue), but the terminology used especially in the higher level ICT governance act [2.1] is ambiguous: “follows,” “participates,” “suggests,” “enables” leave room for subjective interpretation. Respondents [1.6] have criticized the particular act: “The biggest challenge in executing the law has been that there is no clear understanding and consensus within the administration about the descriptions and specifications.” Multiple overlapping laws and regulations – namely the ICT governance act (ICT-specific, under VM), sourcing act (sourcing process-specific, under the Ministry of Labor and Economy) and administrative sector-specific (for example, social and health) acts – may also create strong tensions and complexity for ICT sourcing and project management and require special competences from the participants and responsible authorities. The general approach is to reform the decrees and laws instead of focusing on the problems related to the processes and compliance, as reported by National Audit Office of Finland (VTV) when describing the status of statement processes related to ICT system sourcing. On the operational level, the main ICT governance act [2.1] is regarded as a “dead letter” with more hype than actions. The national service architecture defines the overall picture of digital infrastructure but does not yield support to an interoperability analysis of project deliverables or support the empowerment of technical and project actors. “It is a nice PowerPoint” [1.10] was a common reference on the project level. ICT projects, sourcing, and systems are also governed by various technical factors, such as recommendations from JUHTA (The Advisory Committee on Information Management in Public Administration) and VAHTI (The Government Information Security Management Board), rendering the ICT development as a separate entity from operative process development, as seen by VTV. Most tangible governance models associated with digitalization and projects are left on the executive level. Project manuals and supporting tools and constructs seem to be agency specific, and no formal consolidation or integration takes place. VM aims to construct an explicit governance model (through the Ministerial Committee of Economic Policy) for digitalization, but the draft model seems to follow the same passive mode as the laws above [1.7].

The main responsibility of public sector digitalization in Finland lies on JulkICT, but in practice, they rarely possess any authority over agencies or projects. Money, namely, budgeting, is the strongest governance practice, and the most concrete way to govern organizations and projects. From a project perspective there are three ways to allocate money: the default, “business as usual” method by allocating funds from the agency’s annual budget; the government spearheads projects derived directly from government initiatives (such as KaPA, or VERO’s income register project); and the special budgets, namely, the 100 M€one-off digitalization launch pool. A fourth way to gain financial resources is the productivity fund under VM budgeting committee authority, but this is not systematic, as it also involves non-ICT projects. However, on the operational level, like LIVI, the second and third methods are considered more confusing than supporting, as the money cannot provide long-term capabilities, so the “business as usual” method prevails.

At least one document [2.22] clearly described the roles and responsibilities regarding ICT projects: the owner (the ministry of the administrative sector and its sub-agencies) manages the project from pre-project to post-project and is responsible for statement request process, reporting to the master portfolio, and other compliance practices. On operational level, the roles and responsibilities can be determined by tools such as project manuals, which do not, however, well support non-traditional project delivery models or methods, such as agile development or project alliances. All projects and programs have at least one steering group, and the decision-making power and authority for steering groups are from organizational (agency) level positions. For example, the KaPA program steering group head could make decisions over the program as he was also the ICT director of VRK. The role of stakeholders was identified at executive and operational levels, as seen in Table II. For example, the hierarchal structure of stakeholders in the SaDE program [3.5] was described as Political decision makers > Developer communities > Early adapters > End users. This structure seems to contradict the customer-centric approach of digitalization strategy. However, though the structural complexity of roles and responsibilities was recognized by respondents, and the general principles wove the simplification of administration and reduction of norms, the activities seemed to lead toward further complexity – as seen in [1.7], where the introduction of an investment approach came with yet another informative steering group (the digitalization investment steering group). Also, organizations without any formal authority or governance authority, namely, the D9 digitalization team and DigiNYT committee, were involved in digitalization and ICT projects. External members from non-governmental organizations and the private sector were included in these two groups, but curiously – and maybe unfortunately – no research institutions were represented. Finally, JulkICT supervision, as stated by VTV, does not affect project or program (SaDE and KaPA) execution, as they are not included in the formal project or program structures.

The assurance requirement is conducted on strategic level mainly through reports and statements by direct supervising bodies such as government and committees under parliament or audit organizations. However, the tone of these statements is passive: “needs to be considered,” and the corrective actions are only “proposed” or “suggested” instead of allocated or empowered to specific, responsible authorities. A practical assurance platform for this level, introduced by JulkICT, is the master portfolio aiming to consolidate “most projects [>1M€] across central government.” This platform, along with the decree-mandated statement process for “significant projects” [>5M€] using the VM business case template, includes the only consolidated and shared ICT project assurance practices that reach across levels. JulkICT uses the master portfolio to consolidate status reports for TIETOKEKO, which is the organization coordinating ICT development across the ministries of administrative sectors. TIETOKEKO also receives consolidated reports of ICT projects and, if necessary, makes statements on them but does not conduct any steering activities. Interestingly, JUHTA is not mentioned in this control process description, though it is recognized elsewhere as a significant actor [1.6].

On operational level, assurance equals reporting and documentation, but informal communication is used too. The reporting procedures and structures vary within cases, but all were characterized by complexity: the same or similar information about project and program progress must be reported in multiple directions and irregular intervals. Additionally, as with LIVI, that reporting content plays a role: “Too much information and too many details will backfire.” The capability of JulkICT controllers to assess forecasts and benefits and their tendency to anchor themselves with given numbers is perceived as burdensome, seeming to imply issues with data integrity – a fact that JulkICT also recognized, as “The traffic lights are nicely on green all the time” even though there were known issues [1.3]. Generally, the assurance and authority seem to be characterized by goodwill and assumptions. The applied project measurements were agency-specific, not connected with any results-based incentives, nor were there any sanctions from the owner organization, JulkICT, or TIETOKEKO for exceeding a budget. Post-project benefits realization was supposed to be applied systematically but was not, even among the significant projects.

The segmentation of projects combined with structural complexities made pre- and post-project assessment difficult, as described in the LIVI and MML cases. Finally, different project types require different approaches to assurance as seen in the LIVI and MML cases. However, the formal and rigid assurance processes and procedures do not necessarily support this, which leaves, for example, the agile project level control and steering on “clerical civil disobedience” [1.6]. From a technical perspective, a curious control element is the project’s deliverable validation. ICT projects, especially agile ones, as in the MML case, tend to have a vague concept of a deliverable target, so validating and measuring the outcomes against predetermined targets is challenging. Also, as in the LIVI case, the formal compliance processes and structures, namely, project contracts, need to support flexibility and constant acceptance instead of a fixed stage-gate type of process.

To synthesize the current governance of Finnish public sector digitalization and ICT projects, an external audit report [3.7] identified following issues: strategy formation, target setting, reporting, results-based management and the preparation of regulations. This report is consistent with the findings of this study, which also illustrate how the project governance functions – the application of structures, allocation of roles and responsibilities and requiring assurance – have multiple, vague and ambiguous interfaces between elements and levels, and thus yield to the complexity of the governance structure, as described in Figure 3.

4.2 Project portfolio management assurance requirement practices

The pre-project business case analysis was conducted in all cases as an initial goal alignment practice, but only the significant projects are subject to a more rigorous JulkICT statement process. The strategy toward which a project’s fit is reviewed is in “default” projects the agency’s or ministry’s own strategy. The national digitalization strategy, which is perceived to be impractically vague, is not introduced or applied. The “special” projects reflect the strategic objectives of the government, as they are derived directly from government initiatives. The statement process and master portfolio have a mixed reception at the operational level, as seen in Table III, where they are considered either unnecessary bureaucracy or the de facto practices.

Architectural review in the business case template is mostly superficial and does not receive a formal review from a dedicated technological authority under JulkICT, though the resources and competence do exist. The master portfolio could be used to prioritize and categorize projects but presently is not, though development initiatives have been taken. At the executive level, the applied portfolios are a good start for goal alignment, but, if accompanied by a roadmap that sets program-like mechanisms, the result is more structured. However, it seems lucrative, especially in digitalization, to focus on luxury items like artificial intelligence, but mandatory, hardware-related issues, namely, legacy systems and infrastructure, cannot be neglected either. Deriving projects merely from the technological trends is not feasible. An important factor regarding goal alignment at the executive level is the allocation of resources, especially budget, directly to the portfolio that empowers the owner and increases motivation and delivery capability. However, increased organizational complexity is an imminent risk if the portfolio also allocates fixed human resources and operative process responsibilities, as for example in VERO’s robotics portfolio, turning the portfolio into a new matrix organization. If the portfolio and organizational structures conflict, the governance chain clarity may be endangered. At the operational level, the communication during the prospect phase is actually supported by strict, bureaucratic structures. Project actors can easily determine the responsibilities of administrative sectors and agencies and clearly understand what triggers the inclusion of certain substance specialists. However, this clarity seems to apply only to organizational and administrative aspects, not to the technological or economic sides of pre-project planning. The business case template by VM does not, however, coordinate any formal procedures that would ensure inter-organizational co-operation; it merely asks actors to “describe connections.” Therefore, it seems that besides the formal mechanisms, a lot of communication and coordination within and between levels and organizations is left to the individual’s responsibility. The pre-project phase can extend over a year if the project owner must ensure all elements that are not included in the business case template but needed to secure all practical and technological aspects.

Performance compliance in PPM includes formal review, control and motivation. The motivation from incentives or rewards encouraging either project-level performance, reporting and compliance, and aligning with higher level objectives through portfolios did not take place in any cases, nor is there a formal process describing it. These practices are based on managerial competences and leadership capabilities within organizations, or, to a very limited extent, the remuneration packages of project-level actors, which in Finnish public sector organizations are quite restricted.

The results indicate that there is a control gap at the executive level. Despite having the highest possible legitimate authority, JulkICT considers themselves mostly a quality control and support mechanism for project- and (master) portfolio-related control activities that “Should take place anyway” [1.2-3, 1.6]. This declaration implies a discrepancy between the understanding of actors’ roles and purposes and the mechanisms of digitalization and related ICT projects. As discussed, the control of projects and portfolios are mostly connected to complex reporting and merely informative measurements. Measurements were applied to projects directly or through agency and master portfolios, but there were no consolidated metrics or objectives on any portfolio level. The complexity also characterizes many projects reaching over several areas of organizational responsibility, or, as in the VERO case, the newly introduced sub-portfolio scopes. Besides challenging project ownership, this complexity impedes control by and toward the steering group, consisting of process owners and the VERO-level ICT department. However, control is not just about reporting but also includes steering and planning, which do not come from (master) portfolios or the organizations associated with them but from the owner organization’s chain of command, i.e. steering group and agency line management. The master portfolio is currently only a visual platform yielding a public consolidation report, not otherwise used for formal review or communication. It does possibly enable planning, balancing and optimizing resources, but only one review report [3.4] recognized and suggested this option. This report also gave explicit suggestions on how to develop a master portfolio toward successful PPM. The master portfolio reformation must consider governance and technical ownership, obligations and motivations for budgeting, the comprehensiveness of most ICT projects, the transparency and confidentiality of information and the consolidation and development of project culture.

5. Discussion

In this section, both the project governance and subsequent PPM assurance practices are elaborated through the main organizational levels, the highest strategic, the middle executive and operational project levels. The discussion presents the main empirical findings in respect to the inherent objectives of project governance and PPM on these levels to identify the emerging gaps between findings and current knowledge.

5.1 Strategic level governance and project portfolio management

Instead of building a foundation and purpose for digitalization, the results of this study indicate that strategic level governance is dictated by politically driven, abstract digitalization strategy (or a lack thereof) and different laws and regulations are used mostly for legitimization. The biggest gaps identified were related to the content and formation of digitalization strategy. The strategy consists of various intermittent statements and agendas that do not yield a tangible goal statement, obscuring a consensus or shared understanding of the goals and priorities (Bowman and Ambrosini, 1997). This obscurity creates tension between the project and digitalization strategy, as a project is already a temporary organization that should connect with permanent settings rather than a temporary, short-term political ambitions (Jonas, 2010; Lundin et al., 1995). A feasible policy could be to establish a permanent strategy process and a tangible artefact, in which the political impact from temporary government agendas could be used to establish priorities and principles for vision setting, but a process aimed toward a prioritized, scheduled roadmap of digitalization could be sustained over government terms.

In the parliamentary and democratic public sectors, laws are the most evident mechanism for establishing norms and policies at a strategic level. However, the results of this study indicate two imminent, yet even somewhat paradoxical, issues with the laws: some of them legitimize but do not give authority and at the same time many cause governance overlaps. First, as discussed in Section 4.1, the ambiguity and interpretation challenges of the main ICT governance acts cause distractions. Second, the laws applicable to project processes and technological elements tend to be too detailed in Finland, per a respondent in the MML case. Excessive detail leads to a narrower scope for a single law, restricting its applicability and comprehensiveness. For example, digitalization project processes must comply with at least four different laws, depending on the scope of the project. Updating laws is a time-consuming parliamentary process seriously restricting the rapid evolution of digitalization and flexible ICT projects (Lappi and Aaltonen, 2017). It would still be reasonable to revise and reform the applicable laws from governance perspective into a comprehensive entity that empowers clearly the responsible authorities, reduces the overlap and leaves the functional details out of legal scope.

The aim of assurance at the strategic level is to derive development plans and prioritized objectives from corporate strategy, based on a shared understanding of common goals (Hrebiniak and Joyce, 1984; Kathuria et al., 2007), establishing a subject for goal alignment. In this research and PPM context, this would mean a portfolio on the highest organizational level that interacts with a strategic roadmap to get and enable prioritized objectives. However, therein lies the most current issue of vertical alignment of this multi-case study: no strategy or roadmap is connected with the existing VM master portfolio. The VM master portfolio could be used more effectively to update digitalization internally and externally to provide improved political and public compliance evidence and communication (Mosavi, 2014). Simultaneously, if the digitalization strategy, roadmap and master portfolio were integrated, the target setting and the connections to lower levels (executive level ministries and agencies) would be more feasible.

5.2 Executive level governance and project portfolio management

Based on the empirical findings, the two dominant governance gaps in the executive level could be synthesized into excess amounts of structural complexity, as seen in Figure 3, and an absence of authority. The topic and context itself are so complex that adding structural confusion by adding permanent (D9, DigiNYT) or temporary (Spearhead investment steering group) organizations with an ambiguous purpose and authority will not reduce challenges such as control integrity due to burdensome reporting (Joslin and Müller, 2016a; Walser, 2013). For example, JulkICT’s sense of ownership and authority contradicts any ownership perspectives discussed in project governance literature and can restrict decision-making efficiency, especially in ICT projects (Andersen, 2015; Drury et al., 2012; Olsson et al., 2008). The lack of authority has led to the emerging application of goodwill as an assurance approach, which could be mended with law reformation or by streamlining the budget process so that it flows through the ministries and agencies that actually have the legitimacy and power to govern ICT projects. Emphasizing and clarifying ownership structure would also mitigate the prevailing satisfaction for less mentality but would impose a balancing issue between the centralization and decentralization of power (Janssen and van der Voort, 2016). As JulkICT saw, the organizations conducting projects know the best way to manage them. However, the overall digitalization project delivery capability of central government could be managed as a whole even if the execution and substance-specific knowledge were left in the agencies. Shared and common practices related to project delivery, such as sourcing and choosing the appropriate delivery model, could be included in the discussed governance model, under a project management office (PMO), for example (Mosavi, 2014; Unger et al., 2012). Equally important aspects of more central governance are the common technological elements of digitalization and ICT projects, namely, architecture, interoperability and data (Irani, 2005; Janssen and Klievink, 2012).

Executive-level PPM assurance aims to establish a formal review process for the continuous balance and value maximization of a portfolio and prioritizing projects and their resources according to aligned objectives (Müller et al., 2008; de Reyck et al., 2005). Based on the evidence, the capabilities and motivation to achieve these goals exist, but the lack of authority has rendered the VM master portfolio a mere reporting template. This notion resonates with how institutions gain legitimacy, or through what mechanisms central government constitutes power in digitalization (Scott, 2013). To improve this, the JulkICT and master portfolio legitimacy might be worth re-establishing, along with the content of the actual portfolio for a more complete picture of all central government ICT projects and sub-portfolios (Project Management Institute, 2013) of different agencies and a formal, stage-gate process (Cooper, 2008) to facilitate the steering and control of portfolios.

5.3 Operational level governance and project portfolio management

The implications from the results were that the operational level assurance of related to ICT projects is characterized by a low amount of metrics and a high amount of reporting, both by the project managers and by external auditors within the public sector administration. The external audits do not yield any corrective actions if they do not include a motivational element for the project owner, such as sanctions (Müller, 2009). The amount of project documentation and reporting shown in the empirical data is currently both a burden and source of confusion for project managers due to the complex governance structure, a fact that especially detracts from the performance of agile ICT projects (Lappi and Aaltonen, 2017; Nuottila et al., 2016). Different project types, namely, agile, and delivery models, such as alliance, have varying approaches to project deliverables and measurements (Love et al., 2010; Vlietland et al., 2016); therefore, the applied governance structure should recognize and support these models and the established assurance practices. The deliverables also connect to another governance aspect of assurance – the post-project benefits realization (Marnewick, 2016; Serra and Kunc, 2014). According to JulkICT, this aspect is already challenging, as they cannot demand the analyses afterward and have difficulties establishing determinants for the benefit or impact of ICT project results, systems, and services. Benefits cannot be realized if the users, either personnel of public administration or the customers, the citizens, do not use them.

Assurance has a strong motivational aspect (Hrebiniak and Joyce, 1984). Controlling and measuring through portfolios does take place, but it is conducted either at agency-level portfolios, or in “special” or significant projects, toward the master portfolio. There was no evidence that either of these control modes provided any steering constituting feedback, which partly caused poor motivation among project managers to report properly. In the personal perspective of project and portfolio actors, the application of project and portfolio results-based incentives could support motivation – not to mention the possibility of sharing project benefits and risks similar to an alliance model (Lahdenperä, 2012; MacDonald et al., 2012). Finally, an important aspect concerning the operational level assurance through PPM is the selection of projects during pre-screening (Archer and Ghasemzadeh, 1999; Bridges, 1999). Currently, each case organization conducts their project evaluation to the best of their knowledge, applying either the business case tool by VM or some other template. To support the higher, executive-level, portfolio control process, the operational level project evaluation tool and review process could be scaled to fit all project sizes and types, though the formal statement process still applies only to the significant (>5m €) projects.

6. Conclusions

This research explored the governance of public sector ICT projects in a complex and high-impact phenomenon – government digitalization. The research describes the project governance and PPM practices of government ICT projects through five thematic focus areas and proposes a three-leveled project governance model for digitalization and ICT projects. This provides the managers and practitioners working in the public sector digitalization context means to better understand how the project governance practices impact ICT projects from e-government perspective. By illustrating and elaborating how these practices are conducted on and between different levels within central government organizations, this research provides new understanding on the sought-after vertical process explorations (Snead and Wright, 2014), thus contributing to e-government research. Similarly, project management academics benefit from this research, as it brings a contextual stream into the PPM discussion, which has so far received limited attention (Müller et al., 2008). Prior research on public sector digitalization and e-government transformation has focused primarily on the macro-level, social phenomenon and the factors that enable or distract from the transformation progress (Gil-Garcia and Martinez-Moyano, 2007). Not until recently the connections between the e-government transformation process and the individual ICT projects and acts of project management have been distinguished and elaborated (Melin and Wihlborg, 2018). This research draws on this initiative and enhances understanding of how the ICT project management and e-government transformation can be integrated through project governance practices. The targets set for government digitalization can be connected to ICT projects through forming a concrete digitalization strategy to align and prioritize projects within portfolios, which can also enable the control and balancing functions. This study also highlights the gaps between current academic discussions on governance mechanisms in a specific contextual setting, thus providing new insights into both e-government and governance research. The findings of this research suggest that governance can also be perceived from technical and delivery method standpoints, besides the commonly used organizational and process perspectives, thus bridging the current gap between ICT and project management research (Joslin and Müller, 2016b; Müller and Martinsuo, 2015).

The governance of public sector digitalization and projects seem to struggle with one underlying dilemma: To govern and align individual ICT projects with the national digitalization effort would require more than just operational level technological and mechanical ICT project governance practices. There is also a need for capability and willingness to govern also the higher-level social, economic and political elements such as processes and organization structures towards citizen and service centric transformation, as proposed for example in the classical NPM models (Cordella and Bonina, 2012). Instead of relying on governance through the traditional organizational silos, the focus should change toward governing the more effective citizen or entrepreneur service processes – bearing in mind of course the administrative restrictions or substance contextualities, such as in the defense sector, for example (Gilchrist et al., 2018). To synthesize the findings of this particular research, the following policy implications on governance and PMM on different organizational levels are proposed in Table IV.

Besides the addressed research scope limitations, this research has several more limitations to discuss. First, as a qualitative case study, drawing generalizable implications is impossible; however, this was not an aim of this research. Second, the data were limited to four public cases and publicly accessible documents; drawing reliable conclusions on such a sample is limited. Third, the research was subject to both respondent and researcher bias; the former were mitigated with supportive material and multiple respondents’ presence when possible and the latter through rigorous triangulation among research and respondents (Yin, 2013). Fourth, as Finland is regarded as one of the most advanced nations in the utilization of digital solutions, the managerial implications provided in this study should be considered restricted and without international comparison; no definite conclusions should be made.

This research opened doors for many interesting research opportunities. First, an interesting topic for future research would be to assess how governable the public sector digitalization and the key actors in it are (Müller et al., 2014) and how this could be perceived in maturity aspects of e-government (Andersen and Henriksen, 2006; Esteves and Joseph, 2008). Second, as discussed, a comparative study of the synthesized findings between similar studies from other countries or through a literature review would reveal how broadly applicable or specific to Finland the results are. Third, a longitudinal participation or observation research – simultaneously, by multiple cross-disciplinary researchers, if possible – through different cases (organizations, projects) would validate the findings of this research and bring insight into underlying institutional mechanisms this study did not address thoroughly. Fourth, drawing further from institution theory, specifically institutional entrepreneurship (Maguire et al., 2004; Wijen and Ansari, 2007), an interesting research topic would be to study the performance and activities of the central actor as the active agent or “institutional entrepreneur hero” (Micelotta et al., 2017) of institutional change: digitalization. Finally, studying the processes of transitioning from strategic alignment to social alignment (Gilchrist et al., 2018) and forming and building a consensus of the national digitalization strategy (Bowman and Ambrosini, 1997; Floyd and Wooldridge, 1992; OECD, 2014) could also provide valuable insight into the topic.

Figures

Figure 1.

Analysis framework of the study

Figure 2.

Finnish public administration chart and research focus

Figure 3.

Finnish central government digitalization and ICT project governance structure

Table I.

Governance structure, public document analysis

Level	1. Application of structures	2. Allocating rights and responsibilities	3. Requiring assurance	Illustrative evidence from public documents
A - Strategic	Digitalization governance (technology) is based on National architecture and interoperability Laws define the main mechanisms and responsibilities related to ICT project governance Many digitalization supporting elements construct strategic vision	Main chain of authority follows organizational structures from government to ministry of administrative sector to agency to project Roles and responsibilities of the involved organizations defined by laws and degrees	Public reporting by JulkICT on digitalization projects Main chain of compliance follows organizational structures from project to agency and administrative sector steering to government level bodies	1. [2.1]: subject ministries, agencies and institutions that therefore are under VM ICT governance authority are described explicitly, 2. [3.5] Governance and project control systems of JulkICT have resulted in complex and heavy structures that detract the planning and budgeting processes, 3. [3.5] The statement process required in the IT governance Act should be reformed to support investment approach, 5. [3.4] Consolidation of law reforms that are aimed to support digitalization is proposed under VM responsibility, 6. [2.1]: subject ministries, agencies and institutions that therefore are under VM authority are described explicitly, 7. [2.3] Appointment of Public sector ICT committee (“JUHTA”), including subcommittees such JHKA (architecture), 8. [2.8] Digitalization structure described: Goverment>VM>JulkICT + “JUHTA”, “TIETOKEKO” and “VAHTI”, 9. [2.7] Government agenda sets targets for digitalization on very high level “Public services are digitalized”, 10. [2.9, 3.1-2]: Benchmarking (e.g. DEN, GBR, EST) and guidelines used by VM to set and justify objectives for digitalization governance, 11. [3.7] VM has not created a strategy that would support the steering and governance of the administrative sector, 12. [2.8] Ownership of digital services and related ICT projects stated as one of the nine guiding digitalization principles
B - Executive	Digitalization governance (technology) is based on National architecture and interoperability Laws define the main mechanisms and responsibilities related to ICT project governance Architecture and interoperability depicted in a program and shared internally and externally Stakeholders identified for digitalization and most projects and programs	Many organizations involved in ICT project governance Main chain of authority follows organizational structures from government to ministry of administrative sector to agency to project Budgeting is the main form of empowerment Roles and responsibilities of the involved organizations defined by laws and degrees Mandate for JulkICT implies project portfolio (VM master portfolio) and pre-screening (Business case and statement process), but no PMO role	Mandate for JulkICT implies project portfolio (VM master portfolio) and pre-screening (Business case and statement process) Public reporting by JulkICT on digitalization projects Two internal auditing bodies to assess digitalization and project governance Main chain of compliance follows organizational structures from project to agency and administrative sector steering to government level bodies Clear inclusion criteria and reporting for significant projects in place	1. [2.1]: VM has been appointed to steer the public sector ICT. This includes: A - Plan and depict the public sector national architecture, B - Define and maintain related interoperability requirements, and C - Control the activities related to shared services and common procedures, 2. [3.6]: External audits remark the legal governance and steering complexity that impacts ICT projects and sourcing, 3. [3.8-12]: VM publicly reports ICT performance annually, but cannot require ministries and agencies for input, 4. [3.5] Exceeding the budget does not lead to any corrective actions or sanctions, 5. [3.4] External review (financial and impact related to digitalization principles) of 17 most important digitalization projects, 6. [2.1]: Responsibility to request statement about ICT project from VM is stated, but also enables the overrule by the responsible ministry, 7. [2.1.] VM tasked with describing interoperability requirements, 8. [3.6] VM has divided ICT project-related responsibilities between JulkICT (ICT governance) and Personnel and administration department (sourcing process, administration governance and structures), 9. [2.8] “All ministries and administrative sectors have their own digital strategy”, 10. [3.5] VM has mostly outsourced one of its'most critical and substantial responsibility: the national architecture work, 11. [3.6] VM has received 13 requests for statements between 2011 and 2014, which are low, 12. [3.6] VM must include other responsible authorities to ICT governance work to reduce overlapping and complexity
C - Operational	Architecture and interoperability depicted in a program and shared internally and externally Stakeholders identified for digitalization and most projects and programs on project level Project delivery systems and tools depend on agencies and ministries	Main chain of authority follows organizational structures from government to ministry of administrative sector to agency to project Budgeting is the main form of empowerment Roles and responsibilities of the involved organizations defined by laws and degrees Mandate for JulkICT implies project portfolio (VM Master portfolio) and pre-screening (Business case and statement process)	Mandate for JulkICT implies project portfolio (VM master portfolio) and pre-screening (Business case and statement process) Main chain of compliance follows organizational structures from project to agency and administrative sector steering to government level bodies Centralized inclusion criteria and control process for significant project proposals in place Centralized inclusion criteria and reporting for significant projects in place Project control and steering practices depend on agencies and ministries	1. [3.5] By participating in operative development (ICT projects) JulkICT (VM) creates confusion, 2. [3.6] No systematic incentivization program that would motivate the project organization to comply with digitalization governance, 3. [3.5] Governance and project control systems of JulkICT have resulted in complex and heavy structures that detract the planning and budgeting processes, 4. [2.22] The ownership and responsibilities regarding ICT projects (pre-project, execution and post-project) in regard to master portfolio application (reporting, steering) defined explicitly, 5. [3.5] Budgets of ICT projects are not enforced and actuals are not reconcialiated, 6. [2.22] Significant projects (>5 M€) subject to VM statement review, 7. [2.22] Master portfolio reporting (status + progress + activities + traffic lights: schedule, costs, scope, personnel, risks, benefits + costs: actual, budget, forecast) apply to >1 M€ projects three times per year and 6-12 months after implementation 7. [3.7] VM has not created a centralized strategy and reporting system that would support the comprehensive steering and governance of the government ICT projects

Table II.

Governance structure, empirical case analysis

Level	1. Application of structures	2. Allocating rights and responsibilities	3. Requiring assurance	Illustrative evidence from empirical data
A - Strategic	A new governance model for digitalization introduced - legal restrictions for digitalization still apply Many laws affect digitalization and projects and they are contradicting, not conforming but more considered as background No explicit national digitalization strategy Governance of projects through administrative structures, political governance impacts only temporal government agenda	Government decree has given VM mandate over agencies - but this been used on rare exceptions to actually impact project Also organizations without direct governance leverage (DigiNYT, D9) are involved in digitalization and ICT projects Main chain of authority still follows organizational structures from government to ministry of administrative sector to agency to project	Governance by goodwill and a low expectations Multiple regular and irregular (all the way to Parliament) reports and statements challenge governance structure and burden projects	1. [1.2-3] Government agenda can affect digitalization projects, but it's limited by 4 year scope. Programs exceed, such as KaPA and SaDe, exceed this time restriction, 2. [1.2-3] No formal digitalization strategy, vision or roadmap, government agenda and digitalization principles are “enough”, 3. [1.3] Ministerial working group of reforming operating practices coordinates central government digitalization projects under government, 4. [1.6] Ministerial committee of Economic policy has started to create a governance model for “Assurance of the execution of digitalization” that consists of: A – Government agenda objectives are the foundation of digitalization, B – Customer centricity and productivity are the drivers for digitalization, C – Service and process investments must be managed, D – Mandates for change execution must be issued, E – A whole picture of digitalization status must be created to enable assessment, control and learning, and F – Operative practices must be appropriate, 5. [1.6] Laws impede digitalization by overemphasizing equality over democracy: everybody must have similar access to all services or no changes cannot be made - the so called “Grandma veto”, 6. [1.9] National digitalization strategy non-existent, business as usual does not change, 7. [1.6] Main -and only- actual decision making bodies are government, ministries (chief of staff assembly), and agencies that own the money, 8. [1.9] “ICT governance act is a dead letter”.
B - Executive	Governance of projects through administrative structures, political governance impacts only temporal government agenda. Technological aspects (architecture and interoperability) governed in practice by statements and guidelines from organizations detached from projects (JHKA, VRK), whereas interoperability and overlapping of processes and organizations is not reviewed properly even in big projects Competence management (project and technology) not coordinated or developed systematically through, for example, PMO Projects derived from agency level strategic objectives (roadmap, strategy, development programme) and delivery model decided by owner On agency level architecture work depends on actors competences, architecture as an artifact not used. Administrative sectors have no architecture at all Analysis of stakeholder's salience or importance not systematical	Government decree has given VM mandate over agencies - but this been used on rare exceptions to actually impact project Allocating money (budgeting is most concrete governance practice and it has different paths to reach project - and no permanent digitalization resource (money) pool Project (default case) ownerships decided within agencies, sometimes by government/VM (special case) Also organizations without direct governance leverage (DigiNYT, D9) are involved in digitalization and ICT projects Main chain of authority still follows organizational structures from government to ministry of administrative sector to agency to project	Master portfolio includes over 1 M€ projects, but all projects are to be included in the future if possible - but not enforced Governance by goodwill and a low expectations - VM has no formal leverage to require assurance Multiple regular and irregular (all the way to Parliament) reports and statements burden projects	1. [1.2-3] Ministries (of administrative branches) coordinate their own projects and practices - using a portfolio when applicable, 2. [1.2-3] Three ways to allocate money for project: A - From ministry/agency annual budget (=“default case”), B - From government issued 100 M€ digitalization spearhead budget (“special case A”), and C - From VM controlled productivity funds (“Special case B”), 3. [1.6] VM/JulkICT is not acting as chair in any supervising organization, but has once been able to, through budgeting, force two reluctant agencies into joint project - “a positive exception” as it was described, 4. [1.6]. Governance hierarchy: Strategic steering group to Programme steering group to Project steering group to Project. 5. [1.6] Architects have their own coordination group, 6. [1.8] VERO top management, with process owners, constructs once every two years a roadmap that includes also digitalization objective, 7. [1.9] “National architecture is just a nice powerpoint”, 8. [1.3] Project sourcing or delivery competences are not coordinated across central government - technological procedures (statement process over architecture and interoperability) are covered by in-house (VM) resources and not transferred outside to other ministries, 9. [1.6] DigiNYT role is ambiguous and visionary at best: “DigiNYT is more or less in the clouds high above”, 10. [1.10] Agency level development strategy that describes digitalization programme
C - Operational	Technological aspects (architecture and interoperability) governed in practice by statements and guidelines from organizations detached from projects (JHKA, VRK), whereas interoperability and overlapping of processes and organizations is not reviewed properly even in big projects Projects derived from agency level strategic objectives (roadmap, strategy, development programme) and delivery model decided by owner On project level architecture work depends on actors competences, architecture as an artifact not used. Analysis of stakeholder's salience or importance not systematical Project manuals and guidelines focus on “traditional” delivery models Contract models and terminology, namely, in alliance, cause confusion in ICT projects	Government decree has given VM mandate over agencies - but this been used on rare exceptions to actually impact project Allocating money (budgeting is most concrete governance practice and it has different paths to reach project - and no permanent digitalization resource (money) pool Investment (benefit, risk analyses) perspective lacking from ICT projects Main chain of authority still follows organizational structures from government to ministry of administrative sector to agency to project Different project roles, namely, in agile, cause confusion	Business case statement required for significant projects (over 5 M€) - but not enforced Master portfolio includes over 1 M€ projects, but all projects are to be included in the future if possible - but not enforced Governance by goodwill and a low expectations Multiple regular and irregular (all the way to Parliament) reports and statements burden projects Definition of done and validation of deliverables in ICT projects (e.g. agile and alliance) differ quite significantly from traditional projects	1. [1.2-3] Common practices: A - Statement process for over 5 M€ projects, B - Master portfolio for over 1 M€ projects, both inclusion criteria are consider too high, 2.[1.2-3] Statement process doesn't add value, for example architecture review, main purpose to empower project owner to process benefits and purpose, 3. [1.6] VM governance practices focus on past (reporting, not steering) and are not reliable (“traffic lights on green, who cares”), 4. [1.2-3] The 100 M€ spearhead digitalization projects have an additional investment steering group, 5. [1.8] VM business case template is not enough to ensure project front-end scoping, but much is left on the individual capability of project owner, 6. [1.5] Projects report according to VERO guidelines once per month to steering group and once every three months to VERO top management, 7. [1.5] Responsibility and ownership of post-project benefits were transferred to process organization and not monitored, 8. [1.1] Splitting one project into three according to lifecycle phases (pre-project, development, maintenance) adds additional complexity to steering and benefits realization, 9. [1.1] Project manual used at MML requires specific roles (Project manager) that are not applicable to other than “traditional” projects - and excludes such roles (Product owner) that would have to be included, 10. [1.9] JulkICT does not show on project level, even though it is 8 M€, 11. [1.11] Terminology between alliance contract from construction industry and ICT field are confusing

Table III.

PPM Assurance practices

Level	I - Goal alignment	II - Performance compliance	Illustrative evidence from case and public data
A - Strategic	Agencies define roadmaps to support portfolio target setting and project selections, connection between national digitalization strategy is not evident	VM master Portfolio as reporting platform consolidates large projects over levels, but for parliamentary reporting or steering purposes	1. [2.21] Master portfolio status published online, but not utilized further, 2.[1.5] Government agenda and spearhead objectives reach the project targets, but not systematically through portfolio, 3. [1.8] Clear criteria between main and sub-portfolio inclusion/exclusion and reporting criteria empowers and reduces need for assurance escalation, 4. [3.4] Proposed target state of VM master portfolio would include project portfolio, strategy portfolio, project planning and publication platform
B - Executive	Allocating money is the most concrete method of target setting, communication and resourcing, but the default process is not built for portfolio structure or does not support flexible project deliveries Agencies have own portfolios, ministries of administrative sectors not, but they are not mandatory - more best practice based Agency level portfolios based on themes and can be allocated budget and resources internally, but this is based on agency level personal competences and preferences	VM master Portfolio as reporting platform consolidates large projects over levels, but no data integrity review, steering activities or feedback involved No financial analysis of or other portfolio-level measures for Master or agency level Concrete process description for project proposal (business case template + statement process), but not for portfolio steering Use of sub-portfolios as programs on agency level Risk analysis not included in portfolios	1. [1.8] Portfolios can be used also as programs, but many activities still outsourced (PMO - competence development), 2. [1.8] VERO has an agency level portfolio that is divided into thematic sub-portfolios with dedicated owner, budget, and also human resources, 2. [1.8] Goal setting hierarchy at VERO: VM to VERO Director to (VERO ICT director to) sub-portfolio owners, 3. [1.5] Projects managed through sub-organizational portfolio and resources, 4. [1.2] All project risks seem to be green in traffic lights even though there are significant risks known, 5. [1.9] Motivation to report projects is from supervising/steering body benefit perspective, not so much the portfolio or big picture, 6. [1.2] “We don't ask too much about the projects even though they are on red, but it is just to inform that ‘We know’”, 7. [1.8] Benefits realization and monitoring through projects, not (sub)portfolio even though the budget is allocated to the portfolio, 8. [1.8] VERO main portfolio is not connected with VM master portfolio (“Should be!”), 9. [2.12-17] Templates and instructions for master portfolio describe the criteria, content, and purposes, and responsibilities for significant project reporting, 10. [3.6]. Master Project Portfolio could include also ICT system approach to support architecture work, but does not, 11. [3.4] Proposed target state of VM master Portfolio would include project portfolio, strategy portfolio, project planning and publication platform, 12. [3.6] Some ministries have extended the use of portfolios beyond VM requirements to support planning, 13. [1.3] VM/JulkICT have not explicit mandate for master portfolio, but alignment and compliance is practiced through TIETOKEKO processes, 14. [1.3] Master portfolio itself has not been given measurable objective
C - Operational	Business case tools (e.g. VMs) used to support project selection (during statement review process), but not enforced or used to prioritize or align with strategic objectives, such as architecture Ownership and responsibilities of projects and portfolios clearly assigned and used as main steering connection to project - but not systematically Master portfolio uses visual methods to improve communication and it is used to consolidate project status for upstream, but not to prioritize or steer projects	VM Master Portfolio as reporting platform consolidates large projects over levels, but no data integrity review, steering activities or feedback involved No result based incentives for project or portfolio management Complex reporting systems (inc. portfolios) burden projects Benefits realization of projects (-or portfolio) not done systematically	1. [2.22] The ownership and responsibilities regarding ICT projects (pre-project, execution and post-project) in regard to Master portfolio application (reporting, steering) defined explicitly, 2. [2.22] Inclusion criteria for Master Portfolio reporting: >1 M€ projects included, 3. [2.22]. Master portfolio reporting (status + progress + activities + traffic lights: schedule, costs, scope, personnel, risks, benefits + costs: actual, budget, forecast) of >1 M€ projects three times per year and 6-12 months after implementation, 4. [3.6] Master Project Portfolio reporting seen by other ministries insufficient, 5. [3.5] Budgets of ICT projects are not enforced and actuals are not reconciliated, 6.[1.1] “VM Master Portfolio should be the only reporting tool”, 7. [1.9] Reporting too much details to VM Portfolio will backfire as the capability of JulkICT personnel to interpret and use actuals and forecasts is not trusted, 8. [1.9] Benefits is generally accepted as important to assess, but still the statement process is bureaucratic, 9. [1.9] Business case tool not utilized and nobody cares, 5. [1.9] Digitalization programme and ICT portfolio reported separately, 10. [1.8] Responsibility and ownership of post-project benefits were transferred to process organization and not monitored, 11. [1.8] Architecture review separate from statement process

Table IV.

Project governance and portfolio management in government digitalization

Organizational level in government digitalization	Project governance practices	PPM assurance practices
STRATEGIC LEVEL: Political and regulatory governance system	One comprehensive single law to cover digitalization and ICT development (projects) that mandates and requires compliance Explicit digitalization strategy over government terms that consists of vision, mission and roadmap based on current state analysis Governance model updated to start from strategic level, including stakeholder management	Master portfolio included in roadmap Parliament and public communication through portfolio Master portfolio targets and categories derived from national strategy
EXECUTIVE LEVEL: Management system	Budgeting process streamlined, more flexible, and investment oriented toward projects Strong “linking pin” or Government CIO (JulkICT) to oversee common ICT project governance, including sourcing Only organizations with institutional legitimacy and power must participate in governance Central PMO to oversee general project capability management, substance competence in administrative sectors (ministries, agencies) Main technological elements governed and enforced centrally: Architecture, interoperability and Data	Master portfolio to include A - Cross-organizational/significant projects (“SPECIAL cases”), and B - organizational (ministry, agency level) sub-portfolio status. Value perspective added Master portfolio categorizes, prioritizes and balances (objectives for) A - significant projects, and B - Organizational sub-portfolios All ICT projects are included in, and budgeted and resourced through a portfolio (Master and/or organizational) A formal process also for (Master) portfolio control that includes risk management and interoperability review, scalable for agency level
OPERATIONAL LEVEL: ICT Projects	Project owner owns project and benefits through lifecycle	A portfolio is only reporting and measurement format and reporting is done only once
	Metrics and incentives for ICT projects and digitalization	Metrics and incentives for ICT project and portfolio performance
	Audits as inputs to roadmaps with responsibilities	Constant assessment of project deliverables
	Different project delivery types conceptualized and supported Use of project tools and best practices synchronized and shared	Business case and statement process made scalable to all project sizes and types

Table AI.

Acquired research data details

No.	1. Empirical case material (semistructured interviews and support material)
	Role	Organization	Date	Duration	Additional material	Comments
1.	Project manager and programme manager	MML	7.12.2015	156 min	1. “Project description” (doc), 2. “Project handbook” (pdf), 3. “Project classification” (xls), 4. “Project proposal assessment” (xls)	Two respondents, three researchers, transcribed
2.	Manager (JulkICT)	VM	31.5.2016	135 min	None	Two researchers, transcribed
3.	Unit director (JulkICT)	VM	28.12.2016	137 min	None	One researcher, transcribed
4.	Senior specialist (JulkICT)	VM	14.2.2017	55 min	1. “DigiNYT - strategic review on digital ecosystems” (ppt) 2. “DigiNYT - memo”(doc)	One researcher, over phone, notes
5.	Project manager	VERO	15.2.2017	125 min	None	One researcher, notes
6.	Programme director (JulkICT)	VM	20.4.2017	65 min	1. “Program governance under national architecture” (doc)	One researcher, transcribed
7.	Senior Director (JulkICT)	VERO	20.4.2017	138 min	1. “Digisteering memo” (doc), 2. “DigiNYT digitalization governance model” (ppt), 3.“Digitalization steering decisions memo” (doc)	Two researchers, transcribed
8.	Development director and Project manager	VERO	22.9.2017	140 min	1. “Portfolio and business plan 2016” (ppt), 2. “Strategic steering model” (doc)	One researcher, transcribed
9.	Procurement project manager, Development project manager, Specialist	LIVI	26.4.2017	92 min	None	Two researchers, transcribed
10.	Procurement project manager, Division director, ICT director	LIVI	4.5.2017	62 min	None	Two researchers, notes
11.	Procurement project manager	LIVI	19.9.2017	110 min	None	Two researchers, transcribed

No.	2. Public documentation related directly to digitalization, governance and projects (guidelines, presentations, instructions, manuals, templates, processes and reports)
	Document	Type	Author	Pages	Date and description	Comments
1.	Act on Information Management Governance in Public Administration (“Laki julkisen hallinnon tietohallinnon ohjauksesta”)	Law	Parliament of Finland	5	2017 (orig. 2011): The purpose of this Act is to enhance public service quality and availability by regulating the governance of public sector IT and interoperability of information systems	Online at: www.finlex.fi/fi/laki/ajantasa/2011/20110634
2.	Shared government ICT service arrangement Act (“Laki valtion yhteisten tieto- ja viestintäteknisten palvelujen järjestämisestä”)	Law	Parliament of Finland	6	2017 (orig. 2013): The purpose of this Act is to enhance government ICT operations, improve the quality and interoperability of ICT services, and improve the efficiency of ICT service production	Online at: www.finlex.fi/fi/laki/ajantasa/2013/20131226
3.	Government decree on public sector ICT committee (“Valtioneuvoston asetus julkisen hallinnon tietohallinnon neuvottelukunnasta”)	Decree	Government of Finland	2	2013 (orig.2006): Describes the roles and responsibilities of public sector ICT committee (“JUHTA”)
4.	Government decree on public sector ICT committee (“Valtioneuvoston asetus julkisen hallinnon tietohallinnon neuvottelukunnasta”)	Decree	Government of Finland	1	2016 (orig.2006): Updates the roles and responsibilities of public sector ICT committee (“JUHTA”)	Covers both central government and municipalities. A permanent committee
5.	Public sector ICT committee meeting memos	Memo	Public sector ICT committee (“JUHTA”)	68	2013-2018: “JUHTA” meetings held six times per year	Attachments and supplements over 200 pages
6.	Ministry decree on ICT development and coordination group	Decree	VM	3	2016: Describes the objectives and responsibilities of ICT development and coordination group (“TIETOKEKO”)	Covers central government, under MoF
7.	Goverment programme (“Hallitusohjelma 2015-2017”)	Guideline	Prime Minister’s Office	36	2015: Result of government negotiations
8.	Digitalization governance (“Hyvän hallinnon ja kyvykkyyksien tärkeydestä digitalisaatiossa”)	Guideline	VM	28	4/2017: Public statement on the governance and capability management under national digitalization
9.	National digitalization overview (“Ministers seminar on digitalization”)	Presentation	VM	20	06/2016: Minister of Public reforms' seminar on public sector digitalization
10.	National architecture for digital services	Presentation	VRK	27	03/2017: National digital services and architectures illustration (“in a nutshell”)	PRC is the owner of national service architecture
11.	50 years of public sector ICT and information security (“50 vuotta JUHTAA ja VAHTIA”) seminar presentations	Presentation	VM	77	10/2017: 50 year celebration seminar presentations covering the current future activities and roles of both JUHTA and VAHTI
12.	ICT procurement analysis (“Lomakepohja hankinnoille”)	Template	VM	1	01/2015: ICT procurement business case metadata	Word
13.	Evaluation framework for ICT projects (“Tietojärjestelmien arviointikehikko”)	Template	VM	7	03/2015: ICT project evaluation template	Word. Main business case tool. Used by project owner and auditors
14.	Instructions for evaluation framework (“Ohje arviointikehikon käyttöön”)	Instruction	VM	2	03/2015: Instructions how to evaluate ICT projects with 2.8 template
15.	Light documentation template for project analysis (“Kevennetty hankearvionnin dokumenttipohja”)	Template	VM	7	10/2016: Lighter and more robust version for 2.13 template	PowerPoint
16.	ICT project cost-benefit analysis (“Kehityshankkeiden kustannus-hyötyanalyysi”)	Template	VM	6	1/2016: Analyses, calucations and examples for the 2.13 template	Excel. 1-Impacts, 2-Financial benefits, 3-Non-financial benefits, 4-Costs, 5-Summary
17.	Project analysis and benefit monitoring (“Hankearvioinnit ja hyötyjen seuranta”)	Instruction	VM	21	10/2016: Purpose, objectives and governance related instructions for 2.8 template	PowerPoint
18.	Policies for the development of information management legislation (“Tiedonhallinnan lainsäädännön kehittämislinjaukset”)	Report	VM	219	09/2017: Report by the working group looking into the development and reform needs of current public sector ICT legislation
19.	Project portfolio status, public (“Hankesalkku, julkaistava”)	Report	VM	3	9/2016. Overview of central government ICT project portfolio. Public version.	Excel
20.	Project portfolio status (“Hankesalkku yhteenveto”)	Report	VM	5	9/2016. Report on 2.13	PowerPoint
21.	Project portfolio overview (“Katsaus hankesalkkuasioihin”)	Report	VM	13	6/2016. Presentation about portfolio purpose, status and development agenda.	PowerPoint
22.	Critical ICT project reporting (“Ohje merkittävien hankkeiden raportoinnista”)	Instruction	VM	5	12/2015: Instructions how report significant ICT projects	Planning, development, post-project phases
23.	Public sector ICT guidelines (“Julkisen hallinnon ICT linjauksia”)	Guideline	VM	14	07/2017. Draft published for comments, four topics: 1. Data-and telecommunications services, 2. Device solutions, 3. Communications solutions, 4. ICT service management

No.	3. Public documentation related indirectly to digitalization, governance and projects (reviews, reports)
	Document	Type	Author	Pages	Date and Description	Comments
1.	Principles for digital government strategies	Guideline	OECD	19	10/2013. This document introduces draft “Principles on digital government strategies: bringing governments closer to citizens and businesses” for discussion by the Public Governance Committee
2.	Public governance review: Finland and Estonia	Report	OECD	264	3/2015. This publication examines public governance arrangements in Finland and Estonia in two key areas: whole-of-government strategy steering and digital governance	Online at: http://www.oecd-ilibrary.org/governance/oecd-public-governance-reviews-estonia-and-finland_9789264229334-en
3.	Digireview 2015 (“Digiselvitys 2015”)	Report	VK	95	12/2015. Report of review on the digitalization and productivity potential of government agencies	State Treasury is central government agencies support organization in digitalization and e-services development
4.	Project analysis overview (“Digistartti hankeaihioiden arviointi”)	Report	VK	69	3/2016. Report of ICT/productivity projects identified during “Digital Sprint” initiative
5.	Digital service development (“Digitaalisten palveluiden kehittäminen and tuotanto”)	Report	VTV	67	06/2016: Report of review on how the efficiency and customerorientation is managed in the digital service development projects governed by the MoF
6.	Integrations under Public ICT contracts (“Yhteentoimivuus valtion ICT sopimuksissa”)	Report	VTV	67	07/2015. Report of review on integrations and interoperatibility issues in central goverment's ICT contracts	National audit office is the main auditing and control body of public sector organizations
7.	Follow-up report on MoF governance (“Jälkiseurantaraportti VMn hallinnonalan ohjausjärjestelmä”)	Report	VTV	5	02/2017. Follow-up report of review on the governance system of Ministry of Finance
8.	Information on government IT administration (“Tietoja valtion tietohallinnosta”)	Report	VM	54	9/2017. Public report: Information on Government IT administration 2016
9.	Information on government IT administration (“Tietoja valtion tietohallinnosta”)	Report	VM	58	9/2016. Public report: Information on Government IT administration 2015
10.	Information on government IT administration (“Tietoja valtion tietohallinnosta”)	Report	VM	60	9/2015. Public report: Information on Government IT administration 2014
11.	Information on government IT administration (“Tietoja valtion tietohallinnosta”)	Report	VM	66	9/2014. Public report: Information on Government IT administration 2013
12.	Information on government IT administration (“Tietoja valtion tietohallinnosta”)	Report	VM	60	9/2013. Public report: Information on Government IT administration 2012
13.	Public services – International comparison (“Asiointi julkisessa hallinnossa - Kansainvälinen vertailu”)	Report	Prime Minister’s Office	82	2017. International comparison study that aims to support public sector reform through digitalization	The study begins with a comparison of eGovernment strategies in EU member countries. A more thorough review of six different public services is then undertaken across five countries that provide highly developed digital services to their citizens