Programme governance: who can submit, review and approve

Governance, in this sense, is the set of rules about who may submit a report, who must review it, and who holds final approval — designed so no single person can both author and approve their own claimed results. This separation of duties is a basic control in almost every accountability framework, precisely because self-review catches far fewer errors (and far less motivated overstatement) than independent review does.

A review process documented in a policy but not actually enforced by the tool people use every day tends to erode under delivery pressure — a deadline arrives, the designated reviewer is unavailable, and the report gets approved anyway "just this once." Whether that separation of duties survives real deadline pressure says a great deal about how genuinely accountable a programme's reporting actually is.

Report review chains are admin-configured: a step is assigned to a specific user or to an existing role, scoped to the Lead organization or to one Implementing Partner — never to a job title alone. Only a Lead reviewer can return a report for changes or approve/finalize it, regardless of who authored it.

Every access boundary is re-checked server-side on every request — a guessed report ID returns "not found," never a response that confirms it exists to someone unauthorized.