Design risk-based proposal review gates

Placement

Start with the action that should not happen yet

Write the transition as a verb and an object: release a solution assumption to pricing, rely on a partner commitment, order a bid sample, approve an exception package, or send a document outside the authorized workspace. Give it a specific version and recipient where relevant. “Finish the blue review” describes process attendance; it does not tell anyone which action is controlled. A gate is useful only if the workflow can actually hold that action.

Then describe the failure it must prevent. An unsupported service assumption may spread into several answers and a cost model. A wrong legal entity may invalidate the basis of a commitment. A protected attachment sent to the wrong recipient may not be recoverable merely because the sender deletes a local copy. Separate costly internal rework from an external act whose consequences depend on the procedure and applicable terms. Do not call every edit irreversible, or assume every submission can be recalled.

GovS 002, version 2.1, places assurance before significant decisions and calls for defined decision makers, authorization criteria and prior review requirements at gates. It governs UK government project delivery. The application here is an explicitly adapted bid-control method, not a claim that every supplier must adopt its project lifecycle or number of stages.

Use consequences, uncertainty, detectability and the opportunity to correct as separate planning inputs. A small probability with severe disclosure consequences may justify an early permission check and a final artifact check. A frequent spelling error may be handled continuously without a management gate. A multiplied score built from arbitrary one-to-five ratings does not prove that these risks are comparable. Preserve the reasoning behind the placement, including unknowns and controls that cannot be waived internally.

Entry criteria

Make the review informative before making it formal

An entry criterion answers whether the proposed review can do its job. Identify the exact input set, maturity, source authority, scope and unresolved assumptions that reviewers must receive. A feasibility screening can work from a bounded concept and explicit uncertainty. Approval to promise a performance level may require test results or other accepted substantiation. Calling both meetings a technical review does not make the earlier evidence adequate for the later decision.

NASA’s technical-assessment guidance links a review’s purpose, objectives, entry and success criteria, team composition and resulting actions. Its context is systems engineering. Borrow that separation to define the bid review contract, while leaving the actual evidence threshold to the applicable requirement and competent owner; NASA does not certify the sufficiency of a proposal’s claims.

Keep “not ready for this review” distinct from “reviewed and failed.” Missing evidence can block admission without establishing that the solution itself is impossible. Conversely, the team may already know that a mandatory condition fails. Do not schedule an evidence-gathering meeting to obscure a known adverse result. Record what is missing, who can supply or resolve it, and the latest date at which the gate remains useful.

Entry checks should not become an excuse to postpone every difficult conversation until a complete draft exists. A deliberately narrower early review can test whether an approach is worth developing, with no permission to make the final claim. State its limited question and permitted next work. If the later claim needs a different object, such as an executed partner instrument or rendered file, create a later test for that object. It is new coverage, not simply a second reading of the same paragraphs.

Timing case

A review needs time for an unfavourable answer

Alderwick’s fictional response plan would lock a service design into its commercial baseline at working-time index 16. The supporting evidence will first be admissible at index 10. Review requires two working days, one modeled correction round three, recheck one and the authorized decision one. All steps are serial on the same working calendar, people are confirmed available, and the index denotes elapsed working time from a common origin. These durations are example assumptions, not recommended allowances.

The complete adverse-finding path takes seven working days. To finish before the index-16 transition, review must start no later than index 9. Yet admissible evidence appears only at 10. There is no feasible window: the earliest supported decision is 17, one day after the planned lock. Booking the meeting at 9 does not repair missing evidence, and removing the correction round simply changes the question to whether everything passes first time.

The team examines a separately authorized plan change that moves this internal transition to index 18 without changing an external deadline. The latest review start becomes 11, so readiness at 10 leaves a one-day start window and a forecast decision at 17. That is a timing possibility, conditional on the changed downstream plan, authority and resource evidence. It is not permission to move a buyer deadline or treat the commercial lock as approved.

If correction instead needs five days, the same start at 10 produces a decision at 19 and misses the revised transition by one day. Show that scenario alongside the planned three-day correction, without inventing a probability. A single allowed correction round is a modeling boundary, not a guarantee that a second will never be needed. If the finding cannot be bounded, present the resulting uncertainty to the decision owner rather than writing a convenient zero into the plan.

Feasibility

Check both ends of the window against actual availability

The backwards calculation is local to a protected transition. Connect its review, evidence, correction and decision activities to the full response network before accepting it. A reviewer reserved elsewhere, a fixed committee cutoff or an external evidence wait can remove the apparent window. Use the approved working calendars and actual sequence; adding duration numbers is valid only under the assumptions used in Alderwick’s simplified example.

Where no window exists, identify which premise must change. Evidence might be obtainable earlier, a decision might be split into a limited exploratory stage and a later commitment, or independent downstream work might move. Each option needs a responsible owner and supporting evidence. Starting a final review on an unfinished object is not acceleration unless the review question fits that object. An earlier date entered in a tracking tool is not an intervention.

Allow for the time to assemble and distribute the review pack, resolve access restrictions and secure the decision itself. State whether those durations are inside the review estimate or separate. Avoid counting the same protected reserve at several handoffs. A review that finishes at the last possible instant leaves no margin against its own variability, even if the mathematical inequalities are satisfied.

An urgent bid can use shorter, focused reviews where the tests and competent people still exist. It cannot safely infer that a missing mandatory fact is acceptable because the usual meeting format no longer fits. If no permissible path remains, the gate record should make the required stop or escalation visible. This is a decision output, not a failure to administer the calendar.

Exit and authority

Say what passing the gate actually permits

Give each gate one inspectable record: protected action, failure modes, input versions, entry result, review findings, required closure evidence, reviewer, decision authority, decision time and permitted successor scope. Link detailed findings to their existing issue records instead of copying a second inconsistent list. The person who coordinates the meeting may not have the mandate to accept technical risk, approve a price or disclose a document. Attendance by an executive is not a substitute for an explicit decision.

Exit criteria describe the conditions for the named transition, not a generic percentage complete. “All critical findings closed” is meaningful only if critical is defined and closure evidence is inspectable. A comment marked resolved by its author does not necessarily establish independent recheck. For a criterion with an authorized exception route, preserve the exact acceptance, scope and conditions. Internal acceptance cannot waive the buyer’s controlling requirements or someone else’s rights.

Use separate states for admission, assessment and decision. A pack can be admitted, reviewed with findings and then held. A favourable recommendation can await an authorized decision. A limited continuation can permit only independent reversible work while a critical condition remains open. Its record needs the permitted activities, resource ceiling where relevant, owner, expiry, monitoring and the later action that remains prohibited. Do not display this as an unconditional pass.

For example, Alderwick might receive permission to draft neutral company information while the service design is held. That permission would not allow writers to insert the disputed performance claim, treat provisional pricing as approved or send the offer. If the supposedly independent work begins relying on the held design, its basis has changed and the limit must be enforced. A promise to fix an issue tomorrow cannot justify crossing a boundary that requires closure today.

Coverage

Remove duplicated effort, not independent challenge

Map failure modes to the tests that detect them, the objects tested and the decisions that consume the results. Two meetings that both read the same unsupported estimate have correlated limitations, however senior their attendees. A later check of a newly produced export is different: production can create an error that the source review could not see. Keep the distinction between repeated administration and different detection opportunities.

The Orange Book’s risk-monitoring principles describe coordinated assurance without gaps or unnecessary duplication, and reporting that allows assumptions to be challenged. This is UK public-sector risk guidance, not a bid-review schedule. Applied here, it supports mapping the actual coverage of controls instead of equating the number of review meetings with the strength of assurance.

Combine sessions only when their evidence is ready together, required expertise is present and separate conclusions remain visible. The compliance reviewer can share a room with the quality reviewer without merging their questions or allowing a persuasive answer to offset a mandatory omission. A smaller bid may need few formal decision points, supplemented by continuous checks. A complex shared assumption may need a focused gate before it spreads, even when the surrounding documents are short.

NIST SP 800-218, SSDF 1.1, connects software-security check criteria with recorded outcomes and protected supporting information in PO.4. Its scope is software development. The bid analogy is limited: automated checks should produce evidence for explicit criteria. Their success does not establish truth, legal sufficiency or permission to make an external commitment.

Test the plan before relying on it. Introduce a missing mandatory input, an adverse technical result, an expired conditional permission and a changed source into a dry run. Ask which action stops, who is notified and what evidence permits resumption. A red status that leaves the release path executable is only a warning display. The permitted enforcement mechanism may be technical or procedural, but its owner and observed operation must be clear.

Change and handoff

A gate decision belongs to an evidence version

After an amendment, changed partner term, corrected test result or new export, assess which gate assumptions are affected. Trace the changed input through the claims, prices, files and decisions that consumed it. Hold the affected successors while the authorized owner determines the necessary recheck. Preserve unaffected decisions only with a documented basis for their independence; neither reopening the entire bid automatically nor preserving every green label is a substitute for impact analysis.

W3C PROV-DM distinguishes a plan, an activity, responsibility and revision relationships. That vocabulary helps describe which review used which evidence and which decision superseded an earlier one. It is a provenance model, not an approval policy: a recorded association or revision does not prove the person had authority or the claim was correct.

Retain the earlier result as historical evidence, with its scope and superseding event. Do not delete an adverse finding merely because a later version passed. A file digest can identify the checked object but cannot show that a changed sentence preserves meaning. Where the outgoing package differs from the assessed source, include the production checks and final authorization that cover the actual object and recipient.

An assistant can read authorized inputs, draft the gate map, compare versions, calculate conditional windows and identify uncovered transitions. It must stop when evidence, access, mandate or a required interpretation is missing. Designing this plan does not authorize external contact, resource commitments, risk acceptance, disclosure, signing or submission. Handoff should name the next decision owner and exact unresolved condition, so the human can act without mistaking a proposed gate plan for an executed approval.