Program Governance, Scope Consolidation & Delivery Roadmap
Case Study
About Our Client
Overview
Our client is an Australian mutual bank — a member-owned financial institution operating without the scale or dedicated compliance resourcing of the major banks. Like many mutuals, it relies on a small, multi-skilled team, with little or no Project Management Office (PMO) function. As a regulated financial institution, the bank is subject to the same obligations as much larger players — including AML/CTF requirements and Australia’s incoming Scams Prevention Framework — but with a fraction of the headcount to deliver against them.
The Challenge
Fragmented compliance work landing on a lean team
As part of its commitment to strong governance, the bank had proactively commissioned two independent reviews of its AML/CTF control environment over an eight-month period, alongside its own internal assessments — choosing to get ahead of its obligations rather than wait to be told to act. At the same time it was preparing for Australia’s incoming Scams Prevention Framework. But the work needed to comply was spread across multiple disconnected sources, with no single view of scope or priority across a lean team.
Key challenges included:
- Seven or eight separate input sources feeding the bank’s financial crime obligations — two independent reviews, a Scams Prevention Framework review, a position paper, and an existing financial crime roadmap mixing active and paused projects — all running in parallel.
- A small, multi-skilled team with little or no PMO function, subject to the same AML/CTF and scams-prevention obligations as major banks but with a fraction of the headcount to deliver against them.
- A real risk of duplicated effort and competing priorities taking hold across the small team before the initiatives could be brought together.
- An incoming Scams Prevention Framework — its commencement later moved to 31 March 2027 — where the bank chose to keep momentum rather than treat the extension as room to slow down, given the volume of work still required.
- A need to establish the governance framework to run financial crime remediation as a single, coordinated program.
- A need for a prioritised roadmap the bank’s own team could execute against long after the engagement ended, with full delivery continuing through to the following June.
Services:
- Program Governance Framework Design & Implementation
- Stakeholder Mapping & Engagement
- Scope Consolidation Across Multiple Regulatory Inputs
- Workstream Structuring & Terms of Reference
- Prioritised, Risk-Rated Delivery Roadmap
- RAID Governance & Dynamic Program Reporting
- Steering Committee Establishment (Three Lines of Defence)
- Program Handover & Capability Transfer
Sector
Financial Services
The Approach
One coordinated program the team could sustain
Avocado’s consultant was embedded with the bank for an eight-week engagement, working directly with the Chief Risk Officer, the CTO, the Head of Financial Crime, and the AML & Fraud Manager, before expanding engagement across the wider organisation. The work moved from discovery through consolidation and structure to a clean handover:
Discovery & program charter: Structured workshops with the core sponsor group and a full stakeholder map, followed by roughly 20 to 25 one-on-one sessions to understand what success looked like for each stakeholder. The findings were distilled into a single program charter — endorsed by the Chief Risk Officer, CTO and Head of Financial Crime — that became the reference point for the whole program.
Consolidating the scope: All seven-plus input sources were brought together into one requirement set. An initial total of around 80 items fell to roughly 50 once duplicates were removed — revealing that 30–40% of what the bank thought it had to deliver was the same work being tracked multiple times.
Structuring & sequencing the work: Rather than over-engineer things for a small organisation, Avocado established just two workstreams, each with its own terms of reference and a combined fortnightly forum. The 50 consolidated items were then prioritised (Must/Should/Could/Won’t), risk-rated, and broken into Design, Implement and Embed phases — producing an activity-level roadmap of around 1,200 lines, with a Gantt view overlaid with team impact so the bank could see exactly where resourcing would pinch across a small pool of people.
Governance & three lines of defence: RAID registers — risks, issues, actions, dependencies, decisions, constraints and the often-overlooked lessons learned — were stood up with named owners and target dates, alongside a steering committee spanning the CRO, CTO, Chief Member Officer and Internal Audit as observer, keeping all three lines of defence engaged from day one. A self-updating master tracker rolled up completion and flagged overdue items so status could be checked at a glance.
A clean handover: The engagement closed with an Executive Committee presentation and a formal, documented handover — talked through directly with the two team members taking over, with a follow-up session to confirm nothing had been missed before Avocado stepped away.
The Outcome
From fragmentation to a single governed program
Within eight weeks, the bank moved from seven-plus disconnected compliance initiatives to a single, governed program with clear ownership, sequencing and evidence of progress.
- Multiple independent reviews, framework requirements and existing projects were consolidated into one traceable scope, cutting duplicated effort by roughly a third.
- A prioritised, risk-rated roadmap gave the bank a defensible, evidence-based answer to any regulator asking whether known gaps were being addressed.
- A live, self-updating tracker gave the small internal team full visibility of progress and resourcing pinch-points, without needing to rebuild reporting from scratch.
- A steering committee and formalised RAID logs embedded governance discipline that the bank’s own PMO could sustain long after Avocado’s departure.
- A structured handover meant delivery continued without disruption, with the program on track for full completion by the following June — well ahead of the bank’s next scheduled independent review.
The Chief Risk Officer, CTO and Head of Financial Crime each gave direct positive feedback on the engagement, with the bank now holding the structures and documentation to replicate similar programs itself. The work laid the foundation for a continued relationship built on trust — and reflects Avocado’s commitment to delivering with certainty.
