By Paulius Petravicius

The Spotter field-service app stayed amber for six weeks. Each report promised recovery. Integration slipped, so the PM borrowed time from testing. At the October go/no-go meeting, the sponsor finally learnt that launch would move by a month. These project tolerances examples start with that failure: nobody had written down where amber stopped.

Nobody needed to lie. Without an agreed line, there was never a clear moment when recovery stopped being the PM’s decision and became the board’s decision.

A tolerance is delegated authority written as a number or a rule. Management by exception works when the line is written down, the forecast is checked against it, and crossing it is normal, not shameful.

A tolerance is the line where my authority as project manager ends. Inside it I fix things and record them. When my forecast says we’ll cross it, it isn’t mine to absorb any more.

Education note: The example bands in this article are InsightSpotter teaching choices, not standards. PRINCE2 7 names the performance targets and the principle of managing by exception; it does not give universal percentages. Your organisation, contract and risk appetite set the real numbers.

Fiction label: Spotter, Sam and the team are fictional teaching characters, not a real project or client. The field-service app is a separate fictional failure case. The bands are teaching examples, not recommended values.

What a tolerance is

Tolerance defines how far a plan may deviate before the next management level must decide. PRINCE2 7 tolerances cover benefits, cost, time, quality, scope, sustainability and risk. PeopleCert’s explanation of version 7 confirms that sustainability was added as a core aspect of project performance.

The business layer—corporate management, programme or customer—sets project tolerances. The board sets stage tolerance for the PM; the PM agrees work-package tolerances with team managers. Escalation goes one level up. The PeopleCert Community practitioner article on management by exception describes the seven targets and the stage/work-package delegation. This is practitioner commentary, not official method guidance.

The UK government’s project delivery standard, GovS 002, uses the same idea: managers of work components should be set “permissible tolerances within which no escalation is required” to the next level of management. APM’s governance guidance connects this with “delegated limits of authority” and escalation routes.

Education note: Organisational risk appetite and tolerance concern the risk the organisation will accept overall. A plan’s risk tolerance bounds delegated exposure on that plan; it must fit within that wider appetite. They are related, different levels of control.

Project tolerances examples: seven targets, different kinds of line

Sam’s booking-service trial uses the following stage bands. Ruth chairs the board. Benefits remain with Ruth as sponsor; Sam monitors the stage evidence rather than taking authority over the business case.

Teaching example; adapt to your context, contract and risk appetite. Every date, amount, count and threshold below is fictional.

Target	Baseline	Example tolerance	How it’s measured	Who holds it	Escalate to
Time	Stage finish 20 Nov 2026	−0 / +3 working days; latest 25 Nov	Integrated plan forecast	Sam, PM	Ruth’s board
Cost	Stage €60,000	−€4,000 / +€2,500; €56,000–€62,500	Actuals + commitments + estimate to complete	Sam, PM	Ruth’s board
Scope	Staff-only trial; REQ-017 retained	All must-haves fixed; up to 2 agreed should-haves may defer	Requirements acceptance matrix	Sam, PM	Ruth’s board
Quality	Acceptance evidence complete	Zero open severity-1 defects at trial start	Test log + technical-lead sign-off	Sam, PM	Ruth’s board
Risk	Supplier recovery before acceptance testing	No single residual threat with impact above €5,000 without board acceptance	Maya’s assessment in RAID	Sam, PM	Ruth’s board
Benefits	Trial evidence supports business case	No reduction in approved benefits accepted at stage level	Benefits forecast + trial learning plan	Ruth, sponsor	Business layer if project benefit tolerance threatened
Sustainability	Existing EU hosting region and devices	No new hosting region; no earlier device refresh	Hosting design + asset plan	Sam, PM	Ruth’s board

On a phone, swipe the table sideways to see all six columns.

The cost band is deliberately two-sided. An underspend could mean incomplete scope or a missing supplier invoice. It deserves investigation rather than automatic congratulations. The quality rule cannot be averaged away by good performance elsewhere.

This table describes authority, not a budget to spend. Tolerance is not contingency. Money reserved to respond to uncertainty serves a different purpose from permission to deviate. Likewise, a budget for authorised changes funds agreed changes; having funds available does not authorise a PM to cross a tolerance.

How to set bands that mean something

Start with the decisions the next level actually needs to make. A sponsor may care more about a complete acceptance window than a small cost movement. A supplier may care about a contractual handover. Write a line that exposes those consequences before they become irreversible.

• Ask what the authority above needs protected. Identify the business commitment, acceptance gate or exposure that would change its decision.
• Name a measure and source. Forecast final cost, not just invoices paid. Forecast the finish from remaining dependencies, not completed-task counts.
• Tighten as uncertainty falls. Review the evidence and agree changes with the authority that set the band. Do not move it during status reporting.
• Use two sides when early or under matters. Early completion without acceptance evidence is not a successful shortcut. An asymmetric band can reflect that.
• Check the contract. Internal delegation cannot rewrite supplier milestones, notice obligations or acceptance terms. Keep the commercial route explicit.
• Choose where flexibility belongs. For timeboxed delivery, a useful practitioner approach is tight time and cost with agreed scope flexibility. This is a delivery choice, not a universal PRINCE2 rule.
• Check the likely workload. A band that catches every wobble invites management by everything. One that catches nothing leaves the board blind.

Education note: In a 2018 post on the APM blog about minimal viable governance, Paul Evans illustrates tightening time and cost tolerances from ±20% initially to ±2–5% near testing or commissioning. Those figures are that author’s example, not an APM standard or a recommendation for this trial.

For scope flexibility, name the items eligible to move before delivery starts. “Two should-haves” only works if the list and acceptance criteria are agreed. Must-haves remain fixed, and a should-have whose removal undermines a must-have is not safely deferrable. A timebox does not make the quality gate flexible.

For risk, agree what the cap measures. Sam’s example uses the assessed financial impact of an individual residual threat, not expected monetary value. Maya provides the assessment; Sam holds the stage delegation. Also review combined exposure: several threats below an individual cap can still undermine the plan or project risk tolerance.

Management by exception example: when a breach becomes an exception

The trigger is a forecast breach, not a historical overrun. If the forecast finish is beyond the latest authorised date, the exception exists now even while today’s tasks remain on schedule. Cost staying inside its band does not cancel a time exception.

Forecast position	What happens next
Inside tolerance	PM takes corrective action, records it and includes it in the next Highlight Report
Forecast to exceed	Raise the RAID issue and Exception Report now; do not wait for the reporting date
Already exceeded	Raise a late exception; record why escalation was late
Forecast to exceed project tolerance	Board escalates to the business layer

At work-package level, the team manager first alerts the PM. A work-package breach does not automatically mean a stage breach: the PM checks the stage forecast and available authority. At stage level, the PM goes to the board. At project level, the board goes to the business layer. Avoid bypassing a level merely because a problem feels uncomfortable.

For Sam, the record chain is I-012 → Exception Report → D-011 → A-031/A-032. The Highlight and Exception Report guide owns the reports and their templates. An Exception Report presents the forecast problem and options; an exception plan is a replacement plan requested for consideration. Sending a report does not mean a new plan has been approved.

The board can request an exception plan, accept a deviation, change scope or stop the work. It can approve only within its own delegated authority. A stage exception can be resolved by the board while project tolerances remain intact; a project exception cannot be made legitimate just by recording a board vote.

Use one working RAID list for risks and issues, with assumptions and dependencies alongside when relevant. Keep the decision log and the action log separately; both are required on every project. A separate risk register is the rare extra, kept only when governance formally asks for one, such as a PMO, audit, programme or regulator.

Tolerances and RAG: colour follows the forecast

Education note: Under InsightSpotter’s local teaching rules, Green means within tolerance, Amber means approaching a tolerance or an agreed soft threshold, and Red means a forecast breach with an exception raised. These colour rules are not prescribed PRINCE2 bands. The RAG criteria and RAG calculator explain the local approach.

Amber gives the PM an early-warning point; it does not quietly create a second permission limit. If a breach is forecast but escalation has not happened, the control has failed. Do not keep the status amber because the Exception Report is unfinished.

Panos Mastrogiannis’s PeopleCert Community article, linked above, connects watermelon reporting with missing limits, backward-looking updates and a culture that punishes red. It treats exceptions as normal and asks for forecasts and recorded decisions. Absorbing a breach or widening the band quietly is how a reassuring colour hides a worsening position.

Changing a band belongs to the authority that set it, with the reason and effective date recorded. Preserve the earlier baseline and forecast so the change remains visible. The watermelon reporting guide develops that reporting failure. A fresh green label is not evidence that the old exception was handled.

Worked tolerance sheet: Sam’s booking-service trial

Fictional teaching example: At the 30 October stage boundary, after D-009, Ruth’s board agreed this sheet. D-009 had replaced D-004’s 2 December go-live with 9 December 2026, staff-only first, within approved schedule-change authority. The following stage dates are separate teaching additions; the December release remains a future commitment.

Education note: These columns are an InsightSpotter editorial set, not a prescribed management product. This compact sheet adds early-warning points to the bands above. The CSV retains Level, Set by, Linked records and Review date too. Use it as a one-page working summary with links to the source evidence.

Target	Baseline	Tolerance	Measure	Holder	Escalate to	Early-warning
Time	20 Nov finish	20–25 Nov inclusive	Plan forecast	Sam	Board	Forecast 24 Nov or later
Cost	€60,000	€56,000–€62,500 inclusive	Final cost forecast	Sam	Board	≤€57,000 or ≥€62,000
Scope	REQ-017; staff-only	Must-haves fixed; ≤2 eligible should-haves defer	Acceptance matrix	Sam	Board	First eligible deferral proposed
Quality	Acceptance complete	Zero open sev-1 at trial start	Test forecast + sign-off	Sam	Board	Sev-1 closure date uncertain
Risk	Supplier recovery	Individual residual impact ≤€5,000 unless board accepts	RAID assessment	Sam	Board	Impact ≥€4,000
Benefits	Business case preserved	No stage authority to reduce benefits	Benefit forecast	Ruth	Business layer if project tolerance threatened	Evidence collection at risk
Sustainability	EU region; existing devices	No extra region or early refresh	Design + asset plan	Sam	Board	Supplier proposes either change

On a phone, swipe the table sideways to see all seven columns.

Here, working days mean Monday–Friday with no local closures in the example window: three working days after Friday 20 November is Wednesday 25 November. The limits are inclusive; the Amber warning points prompt attention while the forecast remains within the band. A forecast beyond a hard limit takes precedence over Amber.

On 2 November, Alex reports extra supplier rework on the audit export. Sam’s forecast moves the stage finish to 26 November, one working day past the limit. Final cost is forecast at €61,800, still inside its band. Sam does not borrow test time and does not widen the band. He raises I-012 in the RAID log, owned by Noor, and sends an Exception Report with options.

That afternoon, Ruth’s board records D-011 in the decision log. It accepts a 26 November stage finish, conditionally, within the project tolerances the business layer delegated to the board. The 9 December commitment does not change, and neither do the must-haves or the quality gates. The condition: Noor coordinates technical-lead confirmation by 5 November that the full acceptance window and REQ-017 remain protected. If that condition fails, Sam goes back to the board before proceeding.

The follow-ups go in the separate action log. A-031: Alex gets written rework dates from the supplier by 4 November. A-032: Noor assembles the acceptance-window evidence by 5 November. Both link to I-012 and D-011.

This accepts a specific deviation; it does not silently rewrite the original tolerance sheet. Mark the approved exception against the time row, retain the 25 November limit, and attach the conditional decision. Do not mark the issue resolved merely because the board has chosen a route. D-006’s existing fallback acceptance gates also remain in force.

Copy this header row into a spreadsheet to start your own tolerance sheet, one row per target and level:

Target,Level,Baseline,Tolerance (example),Measure + source,Early-warning point,Holder,Set by,Escalate to,Linked records,Review date

What a PM should avoid

• Tolerances that exist only in someone’s head, with no agreed source to check.
• “±10% on everything”, including targets that need a testable rule.
• Waiting for actuals to breach when the forecast has already crossed the line.
• Spending tolerance as though it were contingency or authority to approve changes.
• Widening a band quietly to restore green, or hiding the previous forecast.
• Leaving a band without a named holder and a next-level escalation route.
• Escalating every wobble instead of using the authority already delegated.
• Closing the exception conversation without a decision row and owned follow-ups.

A short PRINCE2 and PMI education note

PRINCE2 7 frames managing by exception as a principle, supported through the progress practice. PMI’s older library material uses variance and performance-threshold language: Bailey’s recovery article recommends clear measures agreed early, while Fleming and Koppelman’s earned-value article explicitly discusses management by exception. Neither establishes a PMBOK 8 mandate for these bands. The vocabulary differs; the useful shared idea is to agree the line before needing it. See the PRINCE2 7 and PMBOK 8 comparison for the wider method discussion.

Checklist: can the team use the line?

• Is every band written down against a baseline, with a measure and source?
• Does every band have a holder and a named authority that set it?
• Is the escalation route one level up, with project authority limits visible?
• Are forecasts checked weekly, and immediately when significant evidence changes?
• Are scope and quality rules testable, including what cannot be traded away?
• Are risk exposure and the sustainability target stated clearly?
• Are Amber warning points distinct from the hard exception trigger?
• Does every board-handled exception end in a decision row and action rows?
• Are accepted deviations and changed bands recorded without erasing history?

The weekly check is an InsightSpotter working rhythm, not a standard reporting interval. Ask owners what remaining work and evidence change the forecast. Keep source updates with their owners; use the sheet to compare them against authority. Escalate between reviews when new information forecasts a breach. Waiting for the weekly meeting would defeat the point.

Tolerances make “Are we OK?” answerable. The RAID log holds the issue, the decision log holds what the board decided, and the action log holds who does what next. Sam’s advantage over the field-service app is a written line, a regular forecast check and a normal route for asking for a decision.

For more practical templates and working habits, join the Insights Spotter newsletter. Take one into your next project review and adapt it with the people who hold the authority.