ISO 21504: ISO 21504 – Tutorial (about 60 minutes)

ISO 21504 is the international guidance standard on project and programme portfolio management, published by the International Organization for Standardization (ISO). It explains how an organisation can look at all of its projects, programmes and related change work as one managed collection, choose the right mix, fund and staff it sensibly, and keep adjusting it so that the whole collection serves the organisation's strategy. Executives, portfolio managers, PMO and finance staff, and anyone who sits on an investment or portfolio board use it as a neutral reference. After this tutorial you will be able to explain what portfolio management is, describe the practices ISO 21504 recommends, and use the guidance to spot weaknesses in how your own organisation decides which work to do.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 21504:2022, Project, programme and portfolio management – Guidance on portfolio management, the second edition, prepared by ISO technical committee ISO/TC 258 (Project, programme and portfolio management) and published in February 2022. It replaced the first edition, ISO 21504:2015, which the ISO/TC 258 catalogue now shows as withdrawn. The ISO/TC 258 catalogue lists the 2022 edition as published (stage 60.60), with no revision project and no draft of a new edition registered. Like every ISO standard it is checked in a systematic review at least every five years, so its first review is due around 2027. ISO/TC 258 is separately revising ISO 21500 and ISO 21502 (both at committee-draft stage), which may later affect the family vocabulary but does not change ISO 21504 today. Verified 2026-10-29 against the ISO/TC 258 catalogue, the committee's ISO 21504 project page and national standards-body catalogue entries (publication date 8 February 2022).

Who it is for: executives and members of investment or portfolio boards, portfolio managers and PMO staff who run the decision process, finance and strategy people who allocate budgets, programme and project managers who want to understand why their work is started, paused or stopped, and auditors or consultants who are asked whether an organisation manages its change portfolio well.

Prerequisites: none. A little experience of working on a project helps, but every term is explained when it first appears. If you have completed the ISO 21502 course on project management, you will recognise the family vocabulary.

How to use this tutorial: read the seven lessons in order (about 45 minutes), study the five diagrams, and then spend the remaining time on the reflection questions before you attempt the 25-question knowledge check.

Learning objectives:

You will be able to explain why portfolio management exists, what ISO 21504 covers and what it deliberately leaves out.
You will be able to use the key vocabulary correctly, including portfolio, portfolio component, prioritisation, balancing, optimisation and capacity.
You will be able to describe what kind of document ISO 21504 is and organise its content into concepts, foundations and recurring portfolio practices.
You will be able to walk through a portfolio management cycle, from identifying candidate work to reviewing the benefits it delivered.
You will be able to explain how alignment with ISO 21504 can be assessed, and why no accredited certification against it exists.
You will be able to apply the guidance to a realistic organisation that has more ideas than money and people.
You will be able to relate ISO 21504 to the rest of the ISO 21500 family, to PMI's portfolio standard and to other portfolio and governance frameworks.

Lesson 1 – Origins, purpose and scope

The problem portfolio management solves

Every organisation has more good ideas than it can afford. A hospital wants a new patient record system, a day-surgery unit, a staff scheduling tool and a cyber security upgrade. A software company wants three new products, a platform rewrite and an expansion into two new countries. Each idea usually arrives with an enthusiastic sponsor and a business case that looks convincing on its own. The trouble starts when all of them are approved one by one. Budgets are spread thinly, the same specialists are booked on five initiatives at once, nothing finishes on time, and nobody can say whether the overall collection of work is moving the organisation toward its strategy.

Project management, which ISO 21502 describes, answers the question "are we doing this project right?". Programme management, covered by ISO 21503, answers "are these related projects together delivering the change we need?". Portfolio management answers a different and earlier question: "out of everything we could do, are we doing the right things, in the right amounts, at the right time, with the resources we actually have?". It sits between the strategy of the organisation and the individual pieces of work that carry that strategy out.

Without portfolio management, organisations tend to show a recognisable set of symptoms. Too many initiatives run in parallel, so each one moves slowly. Pet projects survive because nobody has the authority or the information to stop them. Funding follows the loudest voice or last year's budget rather than current priorities. Risk piles up in one area, for example many large technology changes landing in the same quarter. And the organisation cannot explain to its board or its regulator how the money spent on change relates to the goals it has announced.

How the standard came about

ISO's first general guidance standard on project management was ISO 21500:2012. A permanent technical committee, ISO/TC 258, then took responsibility for project, programme and portfolio management and began to build a family of related documents. Portfolio management guidance was published as ISO 21504 in 2015. When the committee later reorganised the family, with ISO 21500:2021 becoming a shared "context and concepts" document and ISO 21502:2020 taking over project management guidance, the programme and portfolio documents were revised as well. The second edition, ISO 21504:2022, is the one in force today. It keeps the same purpose and title as the first edition and fits the shared vocabulary of the family.

Scope: what is in and what is out

According to its scope, ISO 21504 gives guidance on the principles of portfolio management for portfolios of projects and programmes. Three points about this scope matter in practice.

It is written for any organisation: public or private, large or small, in any sector. A charity with ten projects and a multinational with a thousand can both use it, although the formality will differ greatly.
It is guidance, not requirements. Its recommendations are written with "should", not "shall". The organisation is expected to adapt the guidance to its own environment rather than follow a fixed procedure.
It excludes the management of individual projects and programmes, which other members of the family cover, and it excludes other specialised kinds of portfolio, such as financial investment portfolios managed by fund managers. The word "portfolio" in ISO 21504 means a collection of change work, not a collection of shares or bonds.

Because it is method-neutral, ISO 21504 does not tell you which scoring model, software tool or meeting rhythm to use. It describes what good portfolio management should achieve and which practices should be present. Specific methods such as PMI's portfolio standard or the Management of Portfolios guidance from PeopleCert can be mapped onto it.

Figure 1 – Portfolio management links strategic objectives to the work that produces outputs, outcomes and, finally, benefits that feed back into strategy.

Figure 1 shows the value chain in which portfolio management operates. Strategy is expressed as objectives. Portfolio management turns those objectives into decisions about which programmes, projects and other work to fund. That work produces outputs, people use the outputs and change how they work, and the changed ways of working create measurable benefits. The feedback arrows matter: benefit evidence tells leaders whether the strategy is working, and lessons from delivered work shape the next round of portfolio decisions.

Lesson 2 – Key concepts and vocabulary

ISO/TC 258 keeps the official definitions for the family in a separate vocabulary document, ISO 21506. The explanations below are plain-language summaries, not the official wording. Learn them well, because portfolio discussions break down quickly when people use the same word for different things.

Portfolio – a collection of work that an organisation groups together so that it can be managed as a whole in pursuit of its strategic objectives. The pieces need not be related to each other; what unites them is that they compete for the same money, people and attention.
Portfolio component – any item inside a portfolio: a project, a programme, a smaller portfolio (often called a sub-portfolio) or other related work, such as a regulatory change activity or a pilot that is not formally run as a project.
Portfolio management – the coordinated activities used to direct and control a portfolio so that it meets the organisation's objectives: selecting components, prioritising them, allocating resources, monitoring progress and changing the mix when needed.
Strategic objective – a goal the organisation has set for itself, for example "reduce customer churn by a third within three years". Objectives give the portfolio its purpose and its main evaluation criteria.
Governance – the framework of authority, accountability and decision rules by which an organisation is directed and controlled. Portfolio governance is the part that decides who may approve, change or stop portfolio components. ISO 21505 gives guidance on it.
Governing body – the person or group with ultimate accountability for the organisation, such as a board of directors or a ministry. It sets strategy and risk appetite and holds management to account for the portfolio.
Candidate component – a proposal that has been submitted for a place in the portfolio but has not yet been approved. Turning candidates into approved components is one of the core portfolio decisions.
Evaluation criteria – the agreed factors used to compare candidates and components, such as strategic contribution, expected benefits, cost, risk, urgency, legal obligation and dependencies.
Prioritisation – putting components in order of importance using the evaluation criteria, so that scarce resources go first to the work that matters most.
Balancing – adjusting the mix of components so that the portfolio as a whole has an acceptable spread of risk, time horizon, type of investment and business area, rather than simply taking the top of the ranked list.
Optimisation – choosing the combination of components that gives the greatest overall value within the organisation's constraints. The best portfolio is often not the sum of the individually best projects.
Capacity – the amount of money, people, skills, equipment and management attention available for portfolio work in a period. Portfolio decisions are only realistic when they respect capacity, including the organisation's ability to absorb change.
Benefit – a measurable improvement that results from an outcome and that a stakeholder perceives as an advantage, such as lower cost per order or higher customer satisfaction. Benefits are the ultimate reason the portfolio exists.
Portfolio roadmap – a time-based view of when components start, reach key decision points and finish, used to spot clashes, dependencies and capacity peaks.
Portfolio manager – the person who runs the portfolio management process day to day: collecting information, preparing analyses and recommendations, and making sure decisions are implemented. Decisions themselves usually sit with a board or committee.

Three distinctions that cause confusion

Portfolio versus programme. A programme groups related components that together deliver a specific outcome, such as a new customer platform; its parts depend on each other. A portfolio groups components because they share resources and serve the strategy, even when they have nothing else in common. Closing a programme means its goal is reached; a portfolio usually continues for as long as the organisation exists, with components entering and leaving it.

Portfolio management versus portfolio governance. Governance sets the rules and holds people to account: who may approve investments of what size, how often the portfolio is reviewed, how much risk is acceptable. Management works within those rules to run the portfolio. In a small organisation the same people may do both, but the two roles should still be recognised.

Doing work right versus doing the right work. A project can be perfectly managed, on time and on budget, and still be a poor use of money because it does not support any current objective. Portfolio management is mostly about the second question, while project and programme management are mostly about the first.

Figure 2 – A portfolio can contain sub-portfolios, programmes, projects and other work, all managed together against one set of objectives.

Figure 2 shows a typical hierarchy. The enterprise portfolio is driven directly by the strategy. It contains a sub-portfolio for digital services, a programme, a stand-alone project and some other work. The programme in turn contains its own projects. Portfolio decisions are made about the components at the level directly below the portfolio; the programme manager, not the portfolio board, decides how the CRM and contact centre projects are sequenced inside the programme, as long as the programme stays within what the portfolio approved.

Lesson 3 – Structure of the standard

ISO 21504 is a short document compared with many management system standards. Like every ISO document, it opens with a foreword, an introduction, the scope, normative references and terms and definitions. Its scope describes it as guidance on the principles of project and programme portfolio management, intended to be tailored to the environment of each portfolio. The exact clause titles and numbering could not be checked for this course, so they are not given here; read them in the purchased standard. Instead, this lesson groups the content into four parts so that you understand what each kind of material is for. The grouping is a study aid, not the official table of contents.

Part (study grouping)	What it covers (paraphrased)	Question it answers
Scope and terms	What the document applies to, what it excludes, and pointers to the family vocabulary	Is this the right document for my problem?
Concepts	What a portfolio is, how portfolio management relates to strategy, governance, programmes and projects, and why it creates value	What are we actually managing, and why?
Foundations (prerequisites)	What must exist first: clear strategic objectives, governance and decision rights, a portfolio management framework, defined roles, and reliable information	Are we ready to manage a portfolio at all?
Portfolio management practices	The recurring activities: identifying and evaluating candidates, prioritising, balancing and optimising, authorising, monitoring, reporting, reviewing and changing the portfolio, and managing benefits, risks, resources and stakeholders at portfolio level	How do we run the portfolio, week to week and year to year?

The concept part

The concept material places portfolio management in its organisational context. An organisation has a purpose and a strategy; it delivers that strategy through operations, which keep the business running, and through change work, which alters what the business does or how it does it. Portfolio management is the bridge that allocates limited resources to the change work. The guidance stresses that a portfolio is managed as a whole: decisions about one component are made in the light of all the others.

The prerequisites

The prerequisites deserve more attention than they usually receive, because many failed portfolio initiatives skip them. Ranking projects against strategy is impossible if the strategy is vague. Stopping a project is impossible if nobody has clear authority to do so. Comparing proposals is impossible if each arrives in a different format with different assumptions. An organisation therefore needs to establish, before or alongside the practices, foundations such as:

clear, communicated strategic objectives that can be used as evaluation criteria;
a governance arrangement that defines who decides what, at what thresholds and how often;
a documented portfolio management framework: the policy, processes, criteria, templates and calendar the organisation will use;
defined roles with the skills and time to carry them out;
consistent and trustworthy information about components, costs, resources, risks and benefits.

The practices

The practices describe what happens repeatedly once the foundations are in place. They are not a strict sequence; most run continuously and influence one another. They can be grouped into three families: practices that shape the portfolio (identifying, evaluating, prioritising, balancing, optimising and authorising), practices that steer it (monitoring, reporting, reviewing and changing it), and practices that run across it (managing benefits, risks, resources, stakeholders and communication at portfolio level). Lesson 4 walks through them as a cycle.

How to read "should"

Because ISO 21504 is a guidance standard, nearly every recommendation uses "should". This has two consequences. First, an organisation decides how far to apply each recommendation, and it should be able to explain its choices. Second, nobody can be "non-conformant" in the audit sense, because there are no requirements to conform to. The question an assessor asks is not "did you comply?" but "do you do something effective that achieves the intent of this recommendation?".

Lesson 4 – How it works in practice

Roles

ISO 21504 leaves the names of roles to the organisation, but the responsibilities it describes usually land with the following people or groups.

The governing body and top management set strategy, objectives and risk appetite, approve the portfolio management framework and receive regular reports on whether the portfolio is delivering.
A portfolio board, also called an investment committee or portfolio steering group, makes the portfolio decisions: which candidates enter, which components get more or less funding, and which are paused or stopped.
The portfolio manager, often supported by a portfolio office or PMO, runs the process, maintains the information, carries out analyses and prepares recommendations for the board.
Sponsors and managers of components propose candidates, report progress and forecasts, and implement portfolio decisions within their programmes and projects.
Functional and resource managers, finance, risk and operations contribute data about capacity, budgets and the ability of the business to absorb change, and they live with the results.

The portfolio management cycle

Figure 3 shows a practical reading of the practices as a cycle. Each step is described below.

1. Understand strategy, capacity and constraints. The cycle starts by translating strategy into criteria and by establishing how much the organisation can actually do. That means the change budget for the period, the number of people with each key skill, and limits such as regulatory deadlines or the number of changes a front-line team can absorb at once. Capacity is often the binding constraint: many organisations have money but not the specialists to spend it well.

2. Identify candidate components. Ideas arrive from many sources: strategy work, business units, compliance, operations, customers. A good portfolio process provides one front door, with a short and consistent proposal format, so that every idea can be compared fairly. Ongoing components are also candidates in a sense, because each review asks whether they still deserve their place.

3. Evaluate and categorise. Each candidate is assessed against the agreed criteria: contribution to objectives, expected benefits, cost, risk, urgency, dependencies and resource needs. Candidates are also placed in categories, for example "mandatory compliance", "keep the business running", "grow" and "transform". Categories make it possible to compare like with like and to manage the balance between them.

4. Prioritise. Using the evaluation results, the board ranks candidates and components. Mandatory work, such as a change required by law, may bypass the ranking but still consumes capacity, so it must be counted. Prioritisation should be transparent: people whose proposals are ranked low accept the result more readily when they can see how it was reached.

5. Balance and optimise. A ranked list is not yet a portfolio. The board looks at the combination: does it overload one team, concentrate risk in one quarter, starve long-term innovation or ignore one business area entirely? It then adjusts the mix, perhaps accepting a slightly lower-ranked candidate that uses different skills, or deferring a high-ranked one until a key team is free. The aim is the best achievable portfolio within constraints, not the best individual components.

6. Authorise and allocate resources. Approved components receive a mandate, funding and people, often in stages tied to decision points rather than all at once. Candidates that did not make it are rejected or placed in a backlog with a clear reason, so that they can return when circumstances change.

7. Monitor and report. Throughout the period, the portfolio office collects progress, cost, forecast, risk and benefit information from components and presents it at portfolio level: how the portfolio as a whole is performing against the objectives and the plan, where capacity is stretched, and which components are drifting.

8. Review and change. At regular portfolio reviews, and whenever a significant event occurs, the board decides for each relevant component whether to continue, change, accelerate, pause or terminate it, and whether new candidates should enter. Stopping work is a normal and healthy portfolio decision, not a failure: it frees capacity for better uses.

9. Review benefits. Many benefits appear after a project or programme has closed. The portfolio keeps track of them, compares actual benefits with what was promised, and uses the evidence both to report value to top management and to improve future estimates and criteria.

The life of a component inside the portfolio

Figure 4 – The states a component can pass through in a portfolio, showing that pausing, deferring and stopping are planned decisions, not accidents.

Figure 4 follows a single component. Note the backlog state: a good proposal can be worth doing and still wait, because capacity is full. Note also the paths from Active to Paused and to Terminated. If a portfolio has never paused or stopped anything, that is usually a sign that the review step is not working, not a sign that every decision was perfect.

Typical artefacts

ISO 21504 does not prescribe documents, but organisations that follow it usually maintain a small set of artefacts:

a portfolio management framework document describing policy, roles, decision thresholds, criteria and the review calendar;
a portfolio register or inventory listing every candidate and component with its category, sponsor, status, cost, resources and key dates;
a scoring or evaluation model that turns the criteria into a consistent assessment;
a portfolio roadmap and a capacity plan that show when work happens and which teams it loads;
a portfolio dashboard or report for the board and top management;
a benefits register that tracks expected and realised benefits with owners and measures;
a decision log recording what the board decided and why.

Tailoring to size and context

The guidance applies to any organisation, so it has to be tailored. A twenty-person company might run the whole cycle in a monthly one-hour meeting with a single spreadsheet. A government department might have quarterly reviews, independent scrutiny of large investments and a full portfolio office. Organisations working with agile methods often review the portfolio more frequently and fund persistent product teams or value streams rather than individual projects; the portfolio practices still apply, but the units being prioritised are larger pieces of work, often called epics, flowing through those teams. What matters is that every practice is considered and handled in proportion to the size, risk and pace of the portfolio.

Lesson 5 – Assessment, certification and compliance

There is no certification against ISO 21504

ISO 21504 contains recommendations, not requirements. Certification bodies need auditable "shall" statements, so there is no accredited certification of organisations against ISO 21504. A claim that a company is "ISO 21504 certified" should therefore be treated with caution: at most, the organisation can say that its portfolio management is aligned with the guidance and show evidence of that alignment. ISO/TC 258 is developing a separate document on organisational requirements for project, programme and portfolio management (listed in its catalogue as ISO/CD 21514, a committee draft). Until it is published, nobody can say how it will be used, so do not treat it as a certification route today.

How alignment can be assessed

Even without certification, organisations have good reasons to assess their portfolio management: to improve it, to give the governing body assurance, to answer a regulator or a funder, or to compare business units. Common approaches include:

Self-assessment against the guidance. The portfolio office lists the main recommendations, records for each how the organisation meets its intent, and rates the strength of the evidence. This is cheap and useful, but it is only as honest as the people doing it.
Internal audit or independent review. An internal audit team or an external reviewer examines records and interviews board members, sponsors and the portfolio office. Independence makes the result more credible to the governing body.
Maturity models. Models such as PeopleCert's P3M3, which can assess portfolio, programme and project management separately, rate capability on staged levels. They are not ISO 21504 assessments, but they cover much of the same ground and give a structured improvement path.
Governance assessment. ISO 21505 states that it can be used to assess the governance of projects, programmes and portfolios; combining it with ISO 21504 covers both the decision rules and the management practices.

What good evidence looks like

Assessors look for proof that the practices actually happen, not that a policy exists. Strong evidence includes board minutes and decision logs showing that components were approved, paused or stopped for stated reasons; a register that matches reality; evaluation scores that were really used in decisions; capacity plans that were updated when they were breached; and benefits reviews conducted after components closed. Weak evidence includes a framework document nobody follows, a dashboard that shows only green, or a portfolio in which no component has ever been stopped.

Useful portfolio-level measures

The guidance does not set indicators, but assessors and boards often look at measures such as the share of spending linked to each strategic objective, the number of components in progress compared with capacity, the average time from proposal to decision, the proportion of components stopped at a review, forecast versus actual benefits, and how often key people are allocated above their available time. A single measure means little; trends across several reviews tell the real story.

Personal credentials

ISO does not certify people. Training organisations may offer courses on ISO 21504, and professional bodies run their own portfolio credentials, such as PMI's Portfolio Management Professional (PfMP) and the Management of Portfolios (MoP) qualifications from PeopleCert. These credentials show individual knowledge of a particular body of guidance. They say nothing about how well the holder's employer manages its portfolio.

Lesson 6 – Worked example

This example is fictional but realistic. Meridian Freight is a regional logistics company with about 2,500 employees, a central IT department of 140 people and an annual change budget that the board has fixed for the coming year. Its strategy has three objectives for the next three years: improve on-time delivery, reduce cost per shipment, and launch a digital booking service for small business customers. A new regulation on driver working hours also takes effect in eighteen months.

Step 1 – The starting point

The new chief operating officer finds 31 active initiatives, owned by nine different managers. Nobody has a complete list; finance tracks spending by cost centre, not by initiative. The same eight integration specialists are assigned to fourteen initiatives. Five initiatives have been "nearly finished" for over a year. The board asks the COO to bring portfolio management into line with ISO 21504.

Step 2 – Prerequisites first

Rather than starting with a scoring tool, the COO works through the prerequisites. The executive team rewrites the three objectives with measurable targets so that they can be used as criteria. The board approves a short portfolio management framework: a portfolio board chaired by the COO, with the finance director, the IT director and two business unit heads; decision thresholds (business units may approve small improvements within their own budgets, everything larger goes to the portfolio board); quarterly portfolio reviews; and a one-page proposal template. A portfolio manager is appointed from the existing PMO, with two analysts.

Step 3 – Build the register and the capacity picture

The portfolio office spends four weeks building a register of all 31 active initiatives and 17 waiting proposals, recording sponsor, objective, cost to complete, remaining effort by skill, risks and dependencies. It also builds a simple capacity picture: available days per quarter for each scarce skill. The picture is sobering. Committed work needs about 160 % of the integration specialists' available time for the next two quarters.

Step 4 – Evaluate, categorise and prioritise

Each of the 48 items is scored against the three objectives, expected benefits, cost, delivery risk and urgency, and placed in one of four categories: mandatory, run, grow or transform. The driver working-hours change is mandatory and is placed at the top regardless of score, but its effort is counted. The board reviews the scores in a workshop and adjusts a few where sponsors bring new evidence, recording the reasons.

Figure 5 – A value-versus-risk view helps the board see which candidates to prioritise, which need care, and which to question or reshape.

Figure 5 shows one of the views the portfolio office prepares for the board. The route planning upgrade has high value and modest risk, so it is an obvious priority. The digital booking service is highly valuable but risky, so the board approves it in stages with a decision point after a pilot. The legacy billing rewrite scores low on strategic value and high on risk; the board asks its sponsor to reshape it into a smaller, lower-risk change. The intranet redesign is questioned and later dropped.

Step 5 – Balance and optimise

A simple cut-off at the capacity line would have kept the top-ranked items, but nearly all of them need the integration specialists. The portfolio manager models three alternative mixes. The board chooses the second: it keeps the mandatory change, the route planning upgrade and the first stage of the digital booking service; it defers two grow initiatives that need the same specialists until the third quarter; it adds a lower-ranked depot scanner refresh that uses different skills and delivers savings quickly; and it reserves a small share of capacity for urgent work that will inevitably appear. The result reduces planned load on the integration specialists to about 90 % of their available time.

Step 6 – Stop, pause and authorise

The hardest decisions concern existing work. Six active initiatives are terminated because they no longer support any objective or their benefits have disappeared; their sponsors present short closure reports and hand over anything reusable. Four are paused. The five "nearly finished" initiatives are given a firm date to finish or stop. Every decision, with its reason, goes into the decision log. Approved components receive funding for their next stage only, with clear tolerances; going beyond them requires a return to the portfolio board.

Step 7 – Steer through the year

Each month the portfolio office publishes a one-page dashboard: spending and capacity by objective and category, components outside tolerance, top portfolio risks and the status of key benefits. In the second quarterly review, the digital booking pilot shows weak demand from small businesses. Instead of letting the programme continue on momentum, the board reduces it to a smaller second stage focused on the two customer segments that responded well, and releases capacity to one of the deferred grow initiatives.

Step 8 – Benefits and improvement

After a year, the portfolio has fewer active components (19 instead of 31), and more of them finish on time. The route planning upgrade has closed and its benefits owner, the head of operations, reports a measurable rise in on-time delivery, which the portfolio office records against the forecast in the benefits register. An internal audit reviews the portfolio process against ISO 21504 and finds two gaps: benefits for smaller components are rarely reviewed, and capacity data for business teams, as opposed to IT, is missing. Both become improvement actions for the next cycle. Meridian Freight cannot be certified against ISO 21504, but it can now show its board and its lenders, with evidence, how its change budget serves its strategy.

Lesson 7 – Relationship to other standards and frameworks

Inside the ISO 21500 family

ISO 21504 is one member of a family maintained by ISO/TC 258. ISO 21500:2021 provides the shared context and concepts, describing how projects, programmes and portfolios relate to each other and to the organisation. ISO 21502:2020 gives guidance on managing projects, ISO 21503:2022 on managing programmes, and ISO 21504:2022 on managing portfolios. ISO 21505:2017 adds guidance on governance across all three levels, and ISO 21506:2024 collects the vocabulary. Other members cover specific techniques, such as earned value management, work breakdown structures and post-project evaluation. A useful way to remember the arrangement: ISO 21500 is the map, ISO 21502, 21503 and 21504 describe the three management levels, ISO 21505 explains how those levels are governed, and the rest supply shared words and techniques.

Outside the family

Standard or framework	Owner	Focus	Relationship to ISO 21504
ISO 21500:2021	ISO/TC 258	Context and concepts for projects, programmes and portfolios	The umbrella document; read it first to see where portfolio management fits
ISO 21503:2022	ISO/TC 258	Guidance on programme management	Covers the management of programmes, which appear as components in a portfolio
ISO 21505:2017	ISO/TC 258	Governance of projects, programmes and portfolios	Sets the decision rights and accountability within which portfolio management works
The Standard for Portfolio Management	Project Management Institute (PMI)	Detailed portfolio management guidance for practitioners	A professional-body standard with more detail; can be mapped onto the ISO guidance and underpins the PfMP credential
Management of Portfolios (MoP)	PeopleCert (formerly AXELOS)	Portfolio principles, definition cycle and delivery cycle	A practical method, originally developed for UK government, that can be used to implement the ISO guidance
P3M3	PeopleCert	Maturity model with project, programme and portfolio perspectives	Used to assess and improve portfolio capability against staged maturity levels
ISO/IEC 38500	ISO/IEC JTC 1	Governance of IT for the organisation	Governs IT investment decisions at board level; IT change usually appears as portfolio components
ISO 31000	ISO/TC 262	Risk management guidelines	Provides the risk principles that portfolio-level risk management can apply

Choosing between them

These documents rarely compete. A common pattern is to use the ISO family as the neutral reference that defines what good looks like, a detailed method such as PMI's standard or MoP to design the processes and templates, a maturity model such as P3M3 to measure progress, and ISO 21505 or ISO/IEC 38500 to set the governance at board level. When a multinational group needs one language across subsidiaries that each use a different method, ISO 21504 is particularly useful, because every local method can be mapped to it without being replaced.

Agile and lean portfolio approaches

Frameworks for scaling agile, such as SAFe, include a lean portfolio management practice that funds value streams, limits work in progress and uses lightweight business cases. These ideas are consistent with ISO 21504's intent: decisions linked to strategy, respect for capacity and regular re-prioritisation. The main adjustment is in cadence and in what counts as a component: instead of a few large projects reviewed quarterly, the portfolio may manage a flow of smaller items through persistent teams and revisit priorities more often.

Common pitfalls and best practices

Pitfalls seen again and again:

Buying a tool before agreeing the rules. Portfolio software cannot fix vague objectives or unclear decision rights; it only makes the confusion visible faster.
Approving everything. When the board never says no or "not yet", too many components run in parallel, each moves slowly and capacity is exhausted.
Ranking without balancing. Taking the top of a ranked list overloads the same scarce teams and concentrates risk, because strong proposals often need the same skills.
Counting money but not people. Budgets look fine while key specialists are booked at 150 % of their time; delays then spread across the whole portfolio.
Treating stopping as failure. Sponsors defend failing work to avoid blame, and sunk cost becomes the reason to continue.
Forgetting mandatory and operational work. Compliance changes and urgent fixes are left out of the plan, then consume capacity unexpectedly.
Losing sight of benefits. Success is measured only at project closure, so nobody learns whether the promised improvements actually arrived.

Practices that work:

Start with the prerequisites. Make objectives measurable, define decision rights and thresholds, and agree the criteria before scoring anything.
Keep one front door and one register. Every proposal enters the same way and every component is visible in one place.
Plan to capacity, not to budget alone. Model scarce skills and the business's ability to absorb change, and leave a reserve for the unexpected.
Fund in stages. Release money and people stage by stage, with decision points where the case is re-tested.
Make decisions transparent. Publish criteria and record the reasons for approving, deferring and stopping work in a decision log.
Review the whole mix regularly. Hold portfolio reviews on a fixed rhythm and also when major events change the picture.
Track benefits after closure. Give each significant benefit an owner, a baseline and a measure, and review it after the component ends.

Summary and key takeaways

ISO 21504:2022 is the current ISO guidance on project and programme portfolio management; it replaced the 2015 first edition.
Portfolio management asks whether the organisation is doing the right work in the right amounts with the resources it actually has; project and programme management ask whether that work is done well.
A portfolio contains components of any kind: projects, programmes, sub-portfolios and other work, managed together because they serve the strategy and share resources.
The content can be studied as concepts, foundations and practices; the foundations, such as measurable objectives and clear decision rights, are often the hardest part.
The practices shape the portfolio (evaluate, prioritise, balance, optimise, authorise), steer it (monitor, report, review, change) and run across it (benefits, risks, resources, stakeholders).
Pausing and stopping components are normal portfolio decisions that free capacity for better uses.
ISO 21504 uses "should", so there is no accredited certification; alignment is shown with evidence, often supported by maturity models and independent reviews.
ISO 21504 works alongside ISO 21500, 21502, 21503 and 21505, and can be combined with PMI's portfolio standard, MoP, P3M3 and agile portfolio practices.

Reflection questions

Think of your own organisation. Who today decides which new initiatives start, and on what basis? Which of the ISO 21504 prerequisites are missing or weak?
List the five most important pieces of change work you know of in your organisation. Which strategic objective does each serve, and could you defend that link in front of a sceptical board?
When did your organisation last stop or pause a project before it finished? What made that decision easy or difficult, and what would make it easier next time?
Which resource is the real bottleneck in your organisation: money, a particular skill, management attention, or the business's capacity to absorb change? How would you measure it?
If you were asked to show an auditor that your portfolio management is aligned with ISO 21504, which three pieces of evidence would you present first, and why?