Skip to content
PMPHard

PMP Practice: Use methods to support compliance

Question 4 of 6 in Plan and Manage Project Compliance

Pick an answer below — you'll get the explanation instantly, no signup.

Jambo Cloud Solutions is developing a multiplayer mobile game using two-week sprints. The regulatory compliance team has flagged potential violations of children's privacy regulations (COPPA-equivalent in their jurisdiction) that could result in substantial fines if not addressed. The product owner, Rohan Mehta-Singh, has identified three compliance-related user stories that must be completed to avoid regulatory penalties: Story A: Implement parental consent workflow (Story Points: 8, Probability of regulatory audit if not completed: 35%, Estimated fine: $180,000) Story B: Add age verification at registration (Story Points: 5, Probability of regulatory audit if not completed: 60%, Estimated fine: $120,000) Story C: Create data deletion request system (Story Points: 13, Probability of regulatory audit if not completed: 25%, Estimated fine: $200,000) The team's demonstrated velocity is 20 story points per sprint. Jambo must prioritize compliance work for the next sprint but can only fit one major story due to already-committed feature work consuming 12 story points. The CFO has asked her to calculate the expected monetary value of the regulatory risk for each story to inform the prioritization decision. Based on standard risk quantification, which story presents the highest expected monetary value of regulatory exposure if NOT completed in the upcoming sprint?
Show answer & explanation

Correct answer: Story B ($72,000 expected regulatory exposure)

Explanation

Expected monetary value for risk exposure is calculated by multiplying the probability of the risk occurring by its potential financial impact. This calculation helps prioritize compliance work based on actual financial threat rather than story size or perceived severity. For Story A: 35% × $180,000 = $63,000. For Story B: 60% × $120,000 = $72,000. For Story C: 25% × $200,000 = $50,000. Story B presents the highest expected regulatory exposure at $72,000, making it the priority choice when capacity is limited. This approach ensures compliance decisions are data-driven and aligned with business risk tolerance. The calculation does not factor in story point complexity because expected monetary value measures financial threat independently of implementation effort—effort influences what can be done, but EMV identifies what should be prioritized from a risk perspective.

**Why not B:** This represents the correct EMV calculation for Story A ($63,000), but it is not the highest exposure. Story B's EMV is higher at $72,000, making it the greater regulatory threat if left unaddressed.

**Why not C:** This represents the correct EMV calculation for Story C ($50,000), but it is the lowest exposure among the three stories. Despite Story C having the largest potential fine ($200,000), its low probability (25%) results in lower expected value than Story B.

**Why not D:** This distractor results from incorrectly attempting to weight the EMV by story point complexity (dividing $63,000 by 8 story points then multiplying by some factor, or creating a complexity-adjusted formula). Expected monetary value calculations for compliance risk do not incorporate implementation effort—EMV measures financial threat independently of story size. The team's capacity constraints are a separate consideration from risk quantification.

Key Concept

This question covers Use methods to support compliance under Plan and Manage Project Compliance (Business Environment).

Share:

This is 1 of 100 free PMP questions

Unlock 6,300+ PMP practice questions with detailed explanations, progress tracking, and exam readiness prediction.

Unlock All Questions