PMP Practice: Determine Threats to Compliance

In a regulated environment, measuring compliance requires systematic assessment when new guidance emerges, even mid-project. The gap analysis approach allows the project manager to objectively measure the extent of compliance with evolving standards, quantify the impact of addressing gaps versus accepting residual risk, and enable informed decision-making by governance authorities. This approach fulfills the PM's responsibility to provide complete information to decision-makers while respecting the sponsor's authority over scope and schedule trade-offs. The compliance officer has raised a legitimate concern about industry guidance that could affect inspection outcomes, and the sponsor needs clear data on options and consequences—not a unilateral PM decision. The gap analysis documents the current state versus recommended practice, preserves traceability for audits, and allows the organization to make a risk-informed choice about how to proceed.

**Why not B:** This approach fails to recognize that compliance is a continuous measurement activity, not a one-time baseline check. Regulatory environments evolve, and project managers in regulated industries have a responsibility to assess emerging guidance against current plans. Deferring this to 'lessons learned' ignores an active compliance concern during project execution and could expose the organization to regulatory risk. While the baseline was valid at initiation, measuring ongoing compliance requires reassessment when circumstances change.

**Why not C:** This approach misunderstands the nature of regulatory compliance measurement. While FDA guidance documents are not legally binding regulations, they represent the agency's current thinking on acceptable practices and are routinely used as inspection criteria. Waiting for written confirmation of a violation before measuring compliance is reactive rather than proactive. The project manager's role is to assess the gap between current plans and recommended practice, not to negotiate the definition of compliance with the compliance officer or wait for a violation to materialize.

**Why not D:** This approach makes a unilateral decision that exceeds the project manager's authority regarding scope and schedule changes. While compliance is critical, the PM does not have the authority to independently add $180,000 in costs and delay a customer-tied launch date—these are governance-level decisions. The sponsor may choose to accept the risk after understanding the implications, pursue alternative mitigation strategies, or approve the change. The PM's role is to measure and present the compliance gap with options, not to mandate the solution.