What binds this work, what moved most recently, and where no standard exists.
Five practice pages used to carry five versions of this. It sits here instead, so there is one place to check and one date to trust. Every instrument below was checked against its primary source in September 2026, and where one bears on a decision in front of you it gets checked again before you rely on it. A date you get wrong in an attestation is expensive.
PMBOK went to its eighth edition in November 2025. It keeps the seventh edition’s principles and performance domains, simplifies them, and reintroduces process guidance in a non-prescriptive form. PRINCE2 is on version 7. The more disruptive change was quieter: PeopleCert now sells MSP and P3O under PRINCE2-branded umbrellas, though both certifications still exist under their own names. Position descriptions, panel credentials and capability matrices across the sector still use the MSP and P3O names, and will for a while yet.
Where a client would rather not have a proprietary method imposed on them, ISO 21502 and ISO 21503 do the same work without the licensing. In January 2026 they were joined by ISO 21513, which covers evaluating a project or programme after it closes. Benefits assurance has never had a neutral reference before, and our framework says so is a weak answer in front of an auditor.
In Victoria the instruments that bind are the Gateway Review Process and the High Value High Risk framework: six gates, a project assurance plan the Treasurer signs off on, and red or amber findings escalated with a mitigation plan attached. The threshold that catches people is the ICT one: $10 million regardless of funding source, well below the infrastructure equivalents.
Federally it is Gateway under RMG-106, and for benefits it is the DTA's Benefits Management Policy and Standard, which calls for dependency maps, baselines, named owners and confidence levels rather than a page of adjectives.
One to watch: VAGO's 2026–27 plan includes an audit of public sector ICT delivery that looks at whether benefits were actually achieved, not only whether the system was delivered.
One thing worth saying up front: There’s no standard for programme recovery. The nearest things are the Project Routemap, developed by the Infrastructure and Projects Authority and now carried by NISTA, as a diagnostic and the escalation triggers already built into the assurance regimes. Anyone offering you a recovery methodology is offering their own intellectual property, which is fine, as long as that’s how it’s described.
Checked in September 2026. Standards for AI in delivery are drafted but not settled. ISO/DIS 21520 is still in draft and PMI published its own in June 2026. Both are tracked here, and you will hear when either starts to matter.
Two policies now shape what an external firm can even do in this market. The APS Strategic Commissioning Framework has, since October 2023, designated work that must stay inside the public service, and two ANAO audits of its implementation sit in the ANAO work programme. In Victoria, the Silver Review was delivered in June 2025 and released that December alongside the government response. The government accepted some recommendations, declined others and went further in places: fewer layers, wider spans of control, around 330 senior executive and specialist roles cut, 29 public entities removed, and $113 million of the estimated savings attributed to reduced consultant spend.
The conclusion here is probably yours as well. The environment now rewards work that leaves capability behind and penalises work that only rents capacity. What gets designed is handed over with the documentation and governance to run it without outside support. That was true of how Wrenwell worked before the policies landed.
On the design itself, ISO 37000 is the closest thing to a neutral reference for governance and accountability. Almost everything else in this space belongs to somebody. TOGAF covers the architecture side, and the BIZBOK Guide reached v15 in April 2026 with a government reference model in it.
One caution about the product operating model, since it comes up in nearly every conversation. The United Kingdom has started funding digital work by outcome instead of by project, with pilots from September 2025 and end-to-end approvals from April 2026. Australia hasn’t made that shift. The Investment Oversight Framework shapes the investment lifecycle. Advice built on persistent, stably funded product teams has to survive annual appropriation and machinery-of-government change here, and the design allows for that instead of wishing it away.
One piece of decision-rights work has also arrived by policy instead of by choice. Since December 2025 the DTA has required a named accountable official for AI and an AI use-case register, both due by 15 December 2026. If that work has not started, it is a short engagement with a hard deadline attached.
Sources above were last checked in September 2026. The machinery-of-government manual that Victoria still operates under was last updated in February 2020, which is worth knowing before anyone builds a structure on it.
The Digital Service Standard has applied to existing public-facing services since July 2025. The DTA refreshed its assurance framework on 3 August 2026 so that assurance and benefits now sit in one view per investment tier, with triage before anything is formally escalated. Tier 1 investments carry quarterly delivery confidence assessments. In Victoria, Gate 5 is the readiness-for-service review, and Gateway findings are confidential advice to the Senior Responsible Owner rather than a formal stop on go-live.
For the contractual definition of working, ISO/IEC 25010 is what acceptance criteria get written against, and ISO/IEC/IEEE 29119 covers the test process. There is a technical report alongside it, ISO/IEC TR 29119-11, for testing systems built on AI.
Now the part vendors don’t volunteer. There is no published international standard for the reconciliation method itself. ISO 13008 covers digital records conversion and migration as a process, and the nearest work item, ISO/IEC/IEEE 29119-14 on data migration testing, is still a committee draft. ISO 8000 covers data quality, ISO/IEC 38505 covers data governance, and the National Archives' obligations bite on migration, upgrade and decommissioning — but the reconciliation method itself is always somebody's methodology, this one included. That gets said at the outset, and the assurance is scoped against the standards that do exist.
That is why the readiness test that matters is an operational one. Matching row counts tells you the data moved; it does not tell you whether the transactions your operation actually runs can be completed end to end, on migrated data, by the people who run them. The cases worth rehearsing are never the clean ones, but the exceptions nobody wrote down: the amendment, the reversal, the partial payment.
On AI, ISO/IEC 42001 defines the management system and ISO/IEC 42006, which covers the bodies that certify against ISO/IEC 42001, arrived in July 2025. The second one matters more than it appears to, because it means a supplier's AI governance claim can now be audited instead of believed. Government policy moved to version 2.0 in December 2025; the first mandatory requirement landed in June 2026 and the rest falls due in December.
For APRA-regulated clients, CPS 230 has been in force since July 2025. A cutover is now an operational resilience event with notification duties attached, and pre-existing service provider contracts had to comply by the earlier of their next renewal date or 1 July 2026.
Everything above was checked against primary sources in September 2026. If a vendor tells you their migration approach is standards-compliant, ask which standard, and listen carefully to the answer.
The notation has barely moved in a decade. BPMN has sat at 2.0.2 since 2014 with no successor in the works, and DMN went to 1.5 in August 2024, with later revisions in beta at the OMG. DMN is the right tool when the rules are the hard part and the flow is straightforward. Anyone offering you BPMN 3.0 is mistaken.
ISO 9001 is the exception. Its sixth edition arrived in September 2026 — the first substantive revision since 2015 — and the changes land on leadership and culture more than on documentation. Certified clients have a transition to plan for.
Process mining is where the real movement is, though not where the marketing points. The interesting work is in the structure of event data: OCEL 2.0 can express the many-to-many reality of casework that the older XES format cannot. There’s no ISO standard for process mining, and that gets said up front.
Two cautions go to every client before a mining engagement. The architectures that hold up keep the computation separate from the interpretation, because models will invent a metric if you let them. And task mining is a workplace surveillance question before it is an analytics question, so legal and employee representatives belong in the decision before it is switched on. In a public sector setting that conversation belongs at scoping.
For the design work itself, ISO 9241-210 is the human-centred design reference, and APQC's Process Classification Framework, an industry reference rather than a standard, gives a neutral taxonomy to baseline against. The DTA's Digital Experience Policy now carries four standards, with the Digital Access Standard applying to new public-facing services for all audiences from January 2026.
One date is worth putting in the diary. From 10 December 2026, privacy policies must disclose automated decision-making that significantly affects a person. If a redesign automates a decision, that obligation comes with it.
All of this was checked against primary sources in September 2026. The process gets walked before it is redrawn, which takes longer to quote and is the only way to find the workarounds the map does not show.
If you run risk in Victorian government, the framework you are held to changed in September 2025. The VGRMF was reissued after a VAGO performance audit, and references to state significant risks were removed from it. It still binds you through Standing Direction 3.7.1, still carries nine mandatory risk-management requirements and six mandatory insurance requirements, and still ends in an attestation somebody has to sign. If your attestation wording was drafted against the previous edition, it needs review before the next attestation goes out.
Alongside it sit the VPDSF and its twelve security standards: an annual attestation, a protective data security plan every two years, and incident notification once business impact reaches limited. Commonwealth clients are instead subject to section 16 of the PGPA Act and to the PSPF. The PSPF now comes out as an annual Release instead of a standing document — so we comply with the PSPF is a sentence that needs a year attached to it.
Underneath all of it is AS ISO 31000:2018, with IEC 31010 for the assessment techniques. A third edition of ISO 31000 has reached committee draft. No publication date has been announced, and Rebuilding a working framework on the strength of a draft would be premature.
Two recent changes matter more than they appear to. ISO 19011 was replaced in May 2026 and the 2018 edition withdrawn outright, with no transition period, so an audit methodology still citing the 2018 edition is already out of date. And if a maturity-uplift programme is scoped purely on the Essential Eight, plan now for what happens when that guidance next changes.
On the assurance side, the IIA's Global Internal Audit Standards took effect in January 2025 and the Topical Requirements have started landing — cybersecurity in February 2026, third-party risk in September. The Three Lines Model was reissued as a Statement of Position in July 2026.
Privacy keeps moving underneath all of this. The statutory tort for serious invasions of privacy commenced in June 2025. Automated decision-making transparency falls due on 10 December 2026. A second tranche went out as an exposure draft in August 2026 and isn’t law, whatever you may have been told.
Every date above was checked against its primary source in September 2026. A date you get wrong in an attestation is expensive, so where one of these bears on a decision in front of you, it will be checked again before you rely on it.
Three of these come up in almost every scoping conversation. It is cheaper to say so at the start than to be asked in an audit.
Programme recovery. The nearest things are the Project Routemap as a diagnostic and the escalation triggers already built into the assurance regimes.
Migration reconciliation method. Standards exist either side of it, for records conversion, data quality, data governance and the test process, and not for the reconciliation itself.
Process mining. No ISO standard. The movement of the last few years is in the structure of event data rather than in method.
Anyone selling a methodology in these three areas is selling their own intellectual property. That is fine, as long as that is how it is described.