Project controls for developers — what is the minimum viable set?

The five

This is the set that, if you had nothing else, would still catch the failures that actually cost developers money:

• Committed cost, not just actual. The overrun is real the moment a purchase order is approved. Tracking only actuals means finding out thirty to sixty days late, when every option has expired.
• Progress measured by rule, not by opinion. Installed quantities against the bill, not a percentage from a conversation. Subjective progress is optimistic in a predictable direction, which is why the 90% plateau exists.
• A risk register that moves — and that is connected to the notice machinery. The most expensive risk on any project is the one you correctly predicted, watched happen, and failed to notify inside the time bar.
• A delegation of authority the SYSTEM enforces. A matrix in a PDF, with approvals routing by whoever happens to be in the workflow, is a description of governance rather than governance.
• A contemporaneous record you would be willing to defend. Diaries with quantities and constraints, photographs with metadata, correspondence in registers. Not because a dispute is likely, but because the record is fixed long before you know whether you need it.

What is deliberately not on the list

Earned value management, in its full apparatus. Monte Carlo schedule simulation. A 4D model. These are good things and they are refinements — a developer with none of the five above and all of these will still be surprised, because the surprise comes from the gaps, not from the absence of sophistication.

The failure mode in project controls is almost never insufficient technique. It is that nobody wrote down the quantity, nobody chased the notice, and nobody could say who approved the order.

And the sequencing

Do the five in that order, and do not start the sixth thing until the first five are actually happening rather than nominally in place.

The most common way this fails is a developer buying an impressive controls capability and running it on data that nobody is maintaining — which produces an authoritative-looking report built on numbers that came from a conversation.