Business Environment · Topic 2 of 8
Project Compliance
Identify legal, regulatory, security, privacy and contractual obligations, plan how to meet them, and prove compliance through audits in any approach.
- 4 min
- Compliance comes from laws, regulations, standards, contracts and organization policy.
- Identify requirements early and repeat the check when rules change.
- Add compliance work to scope, schedule, cost, quality and risk plans.
What it is
Compliance means meeting the rules that apply to the project and its product. These rules come from laws, regulations, industry standards, contracts and the organization's own policies. Failing to comply can bring fines, legal action, lost contracts, safety harm or reputational damage.
Compliance is a project requirement like any other. It should be identified early, planned, built into the work and checked.
How it works
Sources of compliance requirements
Requirements come from several places.
| Source | Examples |
|---|---|
| Laws and regulations | Safety, environmental, employment, financial reporting, data protection |
| Industry standards | Quality, security and sector specific standards |
| Contracts | Terms, service levels, reporting duties, audit rights |
| Organization policy | Procurement rules, approval limits, security policies |
| Security and privacy | Confidentiality, integrity and availability of data, handling personal information |
For example, a project handling personal data of customers must follow privacy law, such as the General Data Protection Regulation where it applies. The team may need to restrict access, record consent and report incidents.
Planning for compliance
The project manager works with legal, risk, security and quality specialists to list the requirements and understand their effects. Compliance then shapes several plans.
- Scope: compliance deliverables, such as certificates, approvals or documentation, are added as work.
- Schedule: approval periods and inspections are put on the timeline.
- Cost: fees, audits and special tools are budgeted.
- Quality: acceptance criteria and tests include the rules.
- Risk: the risk of non compliance, and of changing rules, is assessed and tracked.
- Resources: specialists and training are planned.
An owner is assigned to each requirement, and the way of proving compliance is defined, such as test records, logs or sign offs.
Managing compliance during delivery
During delivery, the team follows the planned controls and keeps evidence. Audits and reviews check that the work follows the rules, and gaps are logged as issues with corrective actions. Threats to compliance, such as a new regulation or a supplier who does not meet standards, are handled through the risk and change processes.
Procurement must also include compliance in contracts, and the buyer verifies that sellers meet the terms.
Compliance in agile and hybrid projects
Agile teams include compliance in the definition of done, in acceptance criteria and in the backlog. A compliance item might be a story, such as logging access to personal data. Regular reviews and automated checks provide fast feedback.
Hybrid projects often keep formal approvals and documented evidence for regulators, while the teams build the product iteratively. The project manager makes sure that evidence is produced as a by product of the work, not collected in a rush at the end.
Handling a compliance failure
If a breach or gap appears, act quickly. Contain the impact, inform the right people under the governance and legal rules, correct the cause and record lessons. Do not hide it, because concealment usually makes consequences worse.
In scenario questions, a requirement from law or regulation is not optional. Choose the answer that complies and then manages the impact on schedule, cost and scope through change control.
What to remember for the exam
- Compliance comes from laws, regulations, standards, contracts and organization policy.
- Identify requirements early and repeat the check when rules change.
- Add compliance work to scope, schedule, cost, quality and risk plans.
- Assign an owner and define evidence for each requirement.
- Audits and reviews verify compliance, and gaps become issues with corrective actions.
- Agile teams place compliance in the definition of done and the backlog.
- Contracts should carry compliance obligations to suppliers.
- Non compliance is a risk with legal, financial and reputational impact.
- Report breaches promptly, following governance and legal rules.
Common mistakes
Treating compliance as optional. Mandatory rules override convenience, so schedule and scope adjust, not the rule.
Leaving it until the end. Late discovery of a gap causes costly rework.
Assuming the team already knows the rules. Ask legal and compliance specialists, and write the requirements down.
Forgetting suppliers. The project remains responsible for compliance in work it buys.
Keeping no evidence. Compliance that cannot be shown is, in practice, unproven.
Never reduce a compliance requirement to save schedule or cost. Raise a change request and let the right authority decide.
Check yourself
Name two sources of compliance requirements.
Laws and regulations, industry standards, contracts and organization policy are all valid answers.
How do agile teams handle compliance?
They build it into the definition of done, acceptance criteria and backlog items, and check it every iteration.
What should a project manager do after discovering a compliance gap?
Contain the impact, report it through the proper channels, correct the cause and record the lessons.
Topic 2 of 8 in Business Environment
Test yourself on Business Environment
The full PMI PMP question bank has 1,463 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by PMI. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.