Topic 5.3 — Enterprise Project Portfolio Management (EPPM)

In one sentence: Enterprise Project Portfolio Management is how a health and care organization chooses, balances, and steers its whole collection of change — deciding which projects, products, and programmes to fund, in what order, against finite money and people, so that scarce investment lands where it does the most good for patients and citizens.

Why this matters in health and care#

Every NHS body, integrated care system (ICS), and social care organization runs more change than it can afford. Digital ambitions — a shared care record, an electronic patient record (EPR), a patient-facing app, virtual wards, cyber remediation — compete for the same limited capital, the same scarce clinical-informatics staff, and the same finite tolerance of frontline teams for disruption. Without a portfolio view, each initiative is approved on its own merits, and the organization quietly over-commits: too many things start, too few finish, and the ones that matter most for safety or equity are starved by the ones that shouted loudest.

The stakes are public money and public trust. NHS capital is genuinely constrained — the Capital Departmental Expenditure Limit (CDEL) is divided across ICSs as a fixed system capital envelope, and there is rarely enough to do everything (see Key sources). Portfolio choices are therefore rationing decisions with clinical consequences: fund the cyber upgrade or the diagnostics platform; refresh ageing infrastructure or launch the new pathway. EPPM makes that rationing explicit, evidence-based, and accountable, rather than the accidental output of who has the loudest sponsor. It also protects delivery capacity: a realistic portfolio is one the workforce can actually absorb without burning out the very teams it depends on.

Core concepts#

Portfolio. The totality of an organization's investment in change — all its projects, products, and programmes — viewed as one managed collection rather than a list. A portfolio is bounded (a trust's, an ICS's) and aligned to strategy: every item earns its place by contributing to strategic objectives at an acceptable level of risk.

EPPM vs. project, product, and programme. Topics 5.0–11 cover the delivery constructs: a product is an enduring capability run by a stable team (Topic 5.0); a project is a time-boxed effort with a defined output (Topic 5.1); a programme coordinates related projects to deliver an outcome (Topic 5.2). EPPM — the health-and-care application of project portfolio management — sits above all three. It does not deliver anything itself — it decides which products, projects, and programmes should exist, how they are prioritized and balanced, and whether, collectively, they add up to the strategy.

Management of Portfolios (MoP). The recognized UK/AXELOS framework. MoP is built on five principles and organized into two cycles. The portfolio definition cycle decides what the portfolio should contain — understand, categorize, prioritize, balance, and plan — producing a portfolio strategy and a delivery plan. The portfolio delivery cycle keeps it on track — management control, benefits management, financial management, risk, stakeholder engagement, and organizational governance. Definition asks "are we doing the right things?"; delivery asks "are we doing them right, and still the right things?".

EPMO (Enterprise Project Management Office). The standing function that runs EPPM: maintaining the portfolio, enforcing prioritization, running the stage-gates, aggregating reporting, and stewarding capacity. An EPMO differs from a project management office or programme office in altitude — it serves the executive and board, connecting strategy to execution in a closed loop, not administering a single delivery.

Stage-gates. Predefined decision points in a phase-gate process (often labelled discovery, business case, build, deploy, close) at which an initiative must be revalidated to continue receiving funding. Gates convert funding from a one-off "yes" into a series of renewable commitments, so money follows evidence rather than sunk cost.

Capacity vs. demand. Demand is everything the organization wants to do; capacity is what its money and people can actually deliver. Portfolio management exists precisely because demand always exceeds capacity, and the job is to hold that line honestly.

Best practices#

1. Establish a single, authoritative portfolio. Maintain one list of every change initiative above a defined threshold, with a consistent record for each — sponsor, strategic objective, cost, benefit, risk, stage, and status. Fragmented lists in separate directorates guarantee double-counting and blind spots. The single portfolio is the precondition for every other practice here.

2. Prioritize against explicit, published criteria. Score initiatives on strategic contribution, benefit, risk, deliverability, and (in health) safety and health-inequality impact, using criteria agreed with the board and visible to all. Transparent scoring turns prioritization from a corridor negotiation into a defensible decision — and lets you say a principled "not yet" to a well-connected sponsor.

3. Balance the portfolio, don't just rank it. A ranked list can still be undeliverable or lopsided. Balance across dimensions — capital vs. revenue, run vs. transform, quick wins vs. multi-year platforms, risk spread, and delivery load on shared teams — so the portfolio is achievable and resilient, not merely a queue of everyone's favourite.

4. Manage capacity and demand as a hard constraint. Size the portfolio to real delivery capacity — especially the genuine bottleneck resources (clinical-informatics leads, EPR configuration specialists, cyber engineers), not just budget. Starting more than you can finish is the most common and most expensive portfolio failure; a smaller portfolio that completes beats a larger one that stalls.

5. Gate funding in stages, and be willing to stop. Fund initiatives to the next gate, not to the end, and use each gate to revalidate the business case against latest cost, benefit, and strategic fit. The hardest, most valuable EPPM discipline is stopping or pausing work that no longer earns its place — freeing capacity for what does.

6. Track benefits at portfolio level, not just delivery. Aggregate expected and realized benefits (benefits realization management) across the portfolio so the board can see whether the whole investment is paying back, and challenge double-counted or evaporating benefits. Delivering outputs on time means nothing if the portfolio's promised outcomes never materialize (see Topic 5.2 — Programme-Led Work).

7. Report a portfolio dashboard the board can act on. Give leaders one concise, current view — RAG status, spend against plan, capacity utilization, gate decisions due, top portfolio risks, and benefits trajectory — refreshed on a regular cadence. The dashboard is the interface between EPPM and leadership visibility (see Topic 10.4 — Visibility for the CEO & Senior Leaders); if the board cannot see the portfolio, it cannot govern it.

8. Right-size the tooling to the maturity. Start with a disciplined spreadsheet and a clear data model; adopt a dedicated portfolio tool only when the manual overhead genuinely bites. A tool enforces nothing on its own — many organizations buy portfolio software and still lack a real portfolio because the underlying decision discipline was never built.

Questions to discuss with your team#

1. How would we decide, out loud and against agreed criteria, which two of our current digital initiatives to pause if the capital envelope were cut by a fifth next year? This question forces the abstraction of "prioritization" into a concrete rationing choice with named victims, which is where most portfolios reveal they have no real criteria at all. In a health and care organization the trade-offs are acute: a paused cyber-remediation programme carries a live safety and regulatory risk, a paused health-inequality initiative widens a gap the board has publicly committed to closing, and a paused EPR wave frees scarce integration engineers but delays a promised clinical benefit. The tension to debate is whether your published scoring weights — safety, statutory duty, benefit, deliverability, inequality impact — would actually produce a defensible answer, or whether the loudest sponsor would still win in the room. Good teams will test their criteria against a real shortlist rather than in the abstract, and will notice where two initiatives score identically yet one is politically untouchable. An honest answer names the specific initiatives, shows the working, and admits which "protected" items are protected by evidence versus by influence. It should also surface whether the organization can even stop work gracefully, or whether sunk-cost inertia and contractual commitments make "pause" a fiction.

2. Do we actually know our true bottleneck capacity — the specific people, not the money — and are we sizing the portfolio to it or to the budget? Budget is the visible constraint and therefore the one organizations manage, but in digital health the binding limit is almost always a handful of scarce specialists: clinical-informatics leads, EPR configuration analysts, integration engineers, information-governance and cyber staff. The debate worth having is whether anyone in the room can state, with evidence, how many concurrent programmes those individuals can genuinely support before quality and safety degrade, or whether that number is simply assumed. Concrete angles include mapping every in-flight initiative against the same short list of named specialists, and asking how many of them are already committed at more than a hundred per cent across "individually approved" projects. A recurring failure mode to examine is that finance sees a balanced budget while the same three engineers appear on nine plans. A good answer distinguishes capacity for money from capacity for people, quantifies the real bottlenecks, and accepts that a smaller portfolio which finishes beats a larger one that stalls. It should also confront the workforce cost: a portfolio the teams cannot absorb burns out the very people it depends on.

3. When a new ministerial or board priority lands mid-year, is our default reflex "add it to the pile" or "what comes out to make room" — and what would it take to make the second reflex normal? This probes whether the portfolio is a steering instrument or merely an inventory that only ever grows. Health and care leaders face genuine, non-optional demand shocks — a new national target, a regulatory must-do, an emergent cyber threat — and the honest question is whether the organization can absorb them by explicit trade-off rather than by silent over-commitment that slows everything. The tension to debate is real: refusing to displace existing work when a statutory duty arrives is not an option, yet accepting every new priority without subtraction is how portfolios quietly become undeliverable. Useful angles include recalling the last three mid-year additions and asking what, if anything, was actually stopped to accommodate them, and whether the board was ever shown the displaced cost. A mature answer describes a standing mechanism — a re-prioritization gate, a reserved contingency, a visible "what we stopped" line in the dashboard — that makes displacement routine and transparent rather than a crisis negotiation. It should also be candid about the cultural work required, since making "stop" a celebrated outcome rather than an admission of failure is as much a leadership challenge as a process one.

4. Can we show, for the initiatives that finished last year, what benefits were actually realized — and would that survive an auditor netting out the double-counting? Portfolios are justified by benefits, yet most organizations track only the benefits they forecast at business-case time and never revisit whether they materialized, so the portfolio's promised return quietly becomes fiction. The debate worth having is whether anyone can point to a delivered initiative and state the cash-releasing saving, the clinical outcome, or the capacity freed that it genuinely produced, as opposed to the number that was written to win approval. In health and care the trap is especially sharp because the same efficiency — beds freed by a virtual ward, admin hours saved by an EPR module — is often claimed independently by three business cases, so the aggregate looks transformational while the organization's actual costs never fall. Concrete angles include picking two completed initiatives and tracing their promised benefits into the accounts or activity data, and asking who owns each benefit after the project team disbands. A recurring failure mode to surface is the evaporating benefit that had no named owner and no baseline, making realization impossible to prove either way. An honest answer distinguishes forecast from realized benefits, reconciles overlaps centrally, and admits where the organization simply does not know. It should also confront whether the board is ever shown realized-versus-promised benefit at portfolio level, or only a comforting pipeline of forecasts.

5. Does our EPMO actually hold decision rights over prioritization and gates, or is it a well-staffed function that collects status and hopes the executive will act on it? An EPMO with no mandate is the most expensive kind of report: it aggregates beautifully and changes nothing, because every real allocation decision is still settled elsewhere by seniority and sponsorship. The question to debate is where the authority to say "not yet", to hold a gate, or to release a bottleneck resource genuinely sits — with the EPMO by delegated mandate, or with whichever director shouts loudest in the room. In health and care this matters because clinical and operational sponsors carry enormous informal weight, and an EPMO that can be overruled by a phone call cannot hold capacity as a hard constraint no matter how good its data. Useful angles include recalling the last time the portfolio function actually stopped or re-sequenced a powerful sponsor's initiative, and asking what happened next. A mature answer is explicit about the EPMO's delegated authority, the executive backing behind it, and the escalation route when a gate decision is contested. It should also be candid about the difference between influence and mandate, since a function that only advises will always be the first thing bypassed under pressure.

6. Is our portfolio genuinely balanced — across run versus transform, capital versus revenue, quick wins versus multi-year platforms, and load on shared teams — or is it just a ranked queue of everyone's favourites? Ranking answers "which matters most", but a portfolio can be perfectly ranked and still undeliverable or dangerously lopsided, because balance is a different discipline from priority. The tension to debate is that the highest-scoring initiatives are often the exciting transform bets, and a portfolio stacked with them can starve the unglamorous "run" work — infrastructure refresh, cyber remediation, keeping the lights on — until something fails. In health and care the balance dimensions are concrete and consequential: too much capital and no revenue to operate what you build, too many multi-year platforms and no near-term wins to sustain confidence, or every major programme leaning on the same three integration engineers. Concrete angles include plotting the current portfolio across two or three of these axes and asking whether any dimension is empty or overloaded, and whether safety-critical run work is protected against shinier new pathways. A good answer treats balance as an explicit design choice the board can see and adjust, not an accidental by-product of scoring. It should also acknowledge that a balanced, resilient portfolio sometimes means funding a lower-scoring item because the mix, not the rank, demands it.

In practice: a health & care example#

An ICS covering three acute trusts, a mental-health trust, a community provider, and its constituent local authorities has thirty-odd digital initiatives in flight: a shared care record, two EPR deployments, a patient app, virtual wards, cyber remediation across all providers, a data platform, and a long tail of directorate projects. Each was approved separately; nobody can say what the system is spending on digital in total, and three programmes are quietly competing for the same four integration engineers.

The ICS stands up an EPMO reporting to the system's digital and finance leadership. Its first act is not to buy a tool but to build one authoritative portfolio — every initiative captured with sponsor, cost split into capital and revenue, expected benefit, risk, stage, and the shared specialist resources it needs. The exercise alone is revealing: total committed spend exceeds the system capital envelope by a third, and the integration-engineer demand is triple the supply.

The EPMO runs a prioritization and balancing session with system leaders against published criteria weighted toward safety, statutory duties, and health-inequality impact. Cyber remediation and the shared care record score highest and are protected; two directorate projects with thin benefit cases are paused; one EPR deployment is re-sequenced six months later to break the integration-engineer contention rather than run both in parallel and fail both. A stage-gate calendar is introduced: nothing proceeds to build without a revalidated business case.

Six months on, the board sees a single portfolio dashboard each month — spend against the capital limit, capacity utilization on the bottleneck teams, gate decisions taken, and a benefits trajectory. When a new ministerial priority arrives mid-year, the conversation is no longer "add it to the pile" but "what comes out to make room?". The portfolio is now a steering instrument, not an inventory.

Sector lenses#

Startup#

A small digital-health company's "portfolio" is really its product roadmap plus a handful of bets funded by a finite runway; burn rate, not a capital envelope, is the binding constraint. Prioritization is existential — every engineer diverted to a low-value feature shortens the time to the next funding round — so the discipline that matters most is ruthless focus, saying no to promising-but-off-strategy opportunities. Governance is deliberately light: the founders and lead investors are the portfolio board, and a weekly review can re-sequence everything without a formal stage-gate calendar. Balancing "run vs. transform" barely applies when almost everything is transform; the risk is starting three products at once and finishing none. The right move is to fund one or two things to a decisive learning milestone and kill the rest early.

Small business#

An established small provider — a GP practice, a community pharmacy, a single-site clinic, a care home, or a small health-tech supplier past the pre-revenue stage — has a real but tiny portfolio: perhaps a clinical system upgrade, a cyber-remediation must-do, and one improvement everyone wants, all competing for the same handful of people and the same thin cash. There is rarely a dedicated digital or IT function, so the "EPMO" is the practice manager or an owner-director doing portfolio choices in the margins of running the service. The binding constraint is neither a startup's runway nor an enterprise's capital envelope but ongoing operating cash and the near-total absence of slack: the same person who would deliver change is also delivering care. Yet the compliance duties — information governance, clinical safety, cyber — are the same ones the big organizations carry, without the specialists to discharge them. The right move is brutal sequencing: pick the one statutory or safety-critical change that must happen this year, do it to completion before starting the next, and lean on supplier-managed and shared-service options rather than pretending to run parallel initiatives in-house.

Enterprise#

An NHS trust, ICS, or large health-tech firm carries dozens of concurrent initiatives spanning capital and revenue, run and transform, under a standing EPMO and a fixed capital envelope. Accountability runs to a board, external auditors, and regulators, so prioritization must be evidence-based, published, and defensible, and bottleneck resources (clinical-informatics leads, integration engineers, EPR specialists) are contended across many programmes at once. The characteristic failure is over-commitment by a thousand individually reasonable approvals; the enterprise's job is to hold capacity as a hard constraint and enforce stage-gates even against well-connected sponsors. Balancing the whole portfolio — protecting safety-critical cyber and diagnostics against shinier new pathways — is where enterprise EPPM earns its keep. Stopping a live programme here is a governed, minuted decision, not a corridor conversation.

Government#

At national level the portfolio is a portfolio of programmes distributed across many delivery organizations, funded through annual spending settlements and subject to HM Treasury business-case scrutiny (the Green Book's five-case model) and parliamentary accountability. Prioritization carries political weight — ministerial priorities can arrive mid-year and must be absorbed without abandoning statutory commitments — and stopping a high-profile programme is publicly visible, so the bias toward continuation is strong. The centre steers largely through funding conditions, independent gateway and assurance reviews, and standardized reporting rather than direct delivery. The defining discipline is transparency and consistency: a national body must be able to show Parliament and the public that scarce capital was allocated to the highest-value change, not to the loudest region or the most photogenic launch.

Common failure modes#

• The portfolio that is just a list. A register with no prioritization, balancing, or gating is an inventory, not a portfolio. Fix: apply explicit criteria and stage-gates; make the list drive decisions.
• Over-commitment by a thousand approvals. Each initiative is individually reasonable, but collectively they exceed capacity, so everything runs slow and late. Fix: size to capacity, and refuse to start what you cannot resource.
• The EPMO as report-collector. A PMO that aggregates status but holds no decision rights adds cost without adding grip. Fix: give the EPMO a clear mandate over prioritization and gates, backed by the executive.
• Zombie initiatives. Projects that no longer fit strategy but keep their funding through sunk-cost inertia. Fix: make "stop" a routine, celebrated gate outcome, not an admission of failure.
• Benefits double-counting. The same saving is claimed by three business cases, so the portfolio's promised return is fiction. Fix: reconcile benefits centrally at portfolio level and net out overlaps.
• Tool before discipline. Buying portfolio software in place of building decision habits produces an expensive database of the same disorder. Fix: establish the decision discipline first; let tooling follow.

Maturity model#

Checklist#

• There is one authoritative portfolio listing every change initiative above an agreed threshold.
• Each initiative records sponsor, strategic objective, cost (capital and revenue), benefit, risk, stage, and shared resources needed.
• Prioritization uses explicit, published criteria weighted for safety, statutory duties, and health inequalities.
• The portfolio is balanced across run/transform, capital/revenue, and risk — not merely ranked.
• Portfolio size is reconciled against real bottleneck capacity, not just budget.
• Stage-gates are enforced, and stopping or pausing work is a normal outcome.
• Benefits are aggregated and reconciled at portfolio level, with overlaps netted out.
• The board receives a concise, current portfolio dashboard on a fixed cadence.
• An EPMO with a real mandate — not just a reporting function — runs the portfolio.
• Tooling is proportionate to maturity; discipline was built before software was bought.

Key sources#

• AXELOS, Management of Portfolios (MoP) — five principles, twelve practices, and the portfolio definition and delivery cycles. https://www.axelos.com/
• NHS England, Capital guidance 2026/27 to 2029/30 — the CDEL / system capital envelope within which digital portfolios are funded. https://www.england.nhs.uk/long-read/capital-guidance-2026-27-to-2029-30/
• HFMA (Healthcare Financial Management Association), Introductory Guide to NHS Finance, Chapter 7.0: Capital funding — capital vs. revenue and the NHS capital regime. https://www.hfma.org.uk/
• Project Management Institute (PMI), The Standard for Portfolio Management — portfolio balancing, capacity, and benefits at portfolio level. https://www.pmi.org/
• Planview / North Highland, EPMO guidance — the Enterprise PMO's role connecting strategy to execution. https://www.planview.com/resources/articles/does-your-organization-need-an-enterprise-pmo/
• See also Topic 5.0 — Product-Led Work, Topic 5.1 — Project-Led Work, Topic 5.2 — Programme-Led Work, Topic 6.0 — Financial Management & Business Cases, and Topic 10.4 — Visibility for the CEO & Senior Leaders.

References#

1. Project portfolio management — Wikipedia — https://en.wikipedia.org/wiki/Project_portfolio_management
2. Project management office — Wikipedia — https://en.wikipedia.org/wiki/Project_management_office
3. Phase-gate process — Wikipedia — https://en.wikipedia.org/wiki/Phase-gate_process
4. Benefits realisation management — Wikipedia — https://en.wikipedia.org/wiki/Benefits_realisation_management
5. Capital expenditure — Wikipedia — https://en.wikipedia.org/wiki/Capital_expenditure
6. Electronic health record — Wikipedia — https://en.wikipedia.org/wiki/Electronic_health_record
7. Integrated care system — Wikipedia — https://en.wikipedia.org/wiki/Integrated_care_system
8. Management of Portfolios (MoP) — AXELOS — https://www.axelos.com/
9. The Standard for Portfolio Management — Project Management Institute (PMI) — https://www.pmi.org/
10. Capital guidance 2026/27 to 2029/30 — NHS England — https://www.england.nhs.uk/long-read/capital-guidance-2026-27-to-2029-30/
11. Introductory Guide to NHS Finance (Chapter 7.0: Capital funding) — HFMA — https://www.hfma.org.uk/
12. The Green Book: appraisal and evaluation in central government — HM Treasury (GOV.UK) — https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-government