Meeting and measuring compliance

Knowing the requirements is only the start. The project must then choose how to meet each one, build those methods into its plans and deliverables, check that they are working, measure the level of compliance and act when gaps appear. The second half of the compliance task in the 2026 outline covers exactly this: applying compliance methods, analysing the consequences of noncompliance, choosing the right actions and measuring compliance. This lesson follows Project Compass as it turns its compliance register into controls and evidence.

Choosing how to comply

For each requirement, the team chooses one or more methods. The choice depends on the requirement, the deliverable and the cost of each approach. Most methods fall into a few families.

Designing compliance in is usually cheapest and most reliable, because it prevents gaps rather than finding them later. Checking is essential but finds problems after they exist; the later a gap is found, the more it costs to fix. This mirrors the quality principle from PMP-131: prevention over inspection.

Building compliance into the plan

Compliance work needs to appear in the schedule, budget and backlog like any other work, or it will be squeezed out. On Compass, the asbestos survey was a predecessor of demolition in the network diagram; the fire inspection was a milestone before the occupancy permit; the privacy impact assessment had to be approved before the app was connected to live patron data; the expert accessibility audit was scheduled two sprints before release 1 so that findings could be fixed; and union consultation had a fixed slot before the self-checkout configuration was finalized. Each of these had an owner and appeared in the integrated schedule, so slippage would be visible.

Measuring compliance

Compliance must be measured, not assumed. Measures can be simple, such as whether a required permit or approval has been obtained, or continuous, such as the share of app screens passing an accessibility audit, the number of open privacy findings or the percentage of staff who have completed required training. Good compliance measures are tied to specific requirements, collected regularly and reported to the people who need them.

The Compass app team tracked accessibility closely. Each sprint, automated tools and a manual screen-reader check found issues, and the team fixed as many as it could within the sprint. The digital services manager reported the trend to the CCB each month.

# Accessibility issues found and fixed per sprint, and the share of screens passing audit.
found =  [14, 9, 11, 6, 5, 3]
fixed =  [6, 10, 9, 8, 6, 4]
screens_total = [8, 12, 15, 18, 21, 23]
screens_pass  = [3, 7, 10, 14, 18, 21]
open_issues = 0
print("Sprint  Found  Fixed  Open  Screens passing")
for s, (f, x, t, p) in enumerate(zip(found, fixed, screens_total, screens_pass), start=1):
    open_issues += f - x
    print(f"{s:>6}  {f:>5}  {x:>5}  {open_issues:>4}  {p}/{t} ({100 * p / t:.0f}%)")
# Expected cost of a privacy breach with and without the vendor data-location control
p_without, p_with, impact = 0.06, 0.015, 400_000
print(f"Expected exposure: ${p_without * impact:,.0f} without the control, ${p_with * impact:,.0f} with it")

Sprint  Found  Fixed  Open  Screens passing
     1     14      6     8  3/8 (38%)
     2      9     10     7  7/12 (58%)
     3     11      9     9  10/15 (67%)
     4      6      8     7  14/18 (78%)
     5      5      6     6  18/21 (86%)
     6      3      4     5  21/23 (91%)
Expected exposure: $24,000 without the control, $6,000 with it

In the first sprint the team found 14 issues and fixed 6, leaving 8 open. By sprint 6, new issues found had fallen to 3 per sprint and 21 of 23 screens passed audit, but 5 issues remained open. That was a useful signal: the team was preventing more issues as the design system matured, yet still not closing the backlog of older ones fast enough to reach zero by release. The product owner moved the open accessibility issues to the top of the next sprint's backlog, which is where they belonged because the definition of done required level AA compliance before release.

Consequences of noncompliance

The outline asks project leaders to analyse the consequences of noncompliance. Consequences can be legal (fines, orders, lawsuits), financial (remediation costs, lost grants, contract penalties), operational (stop-work orders, failed inspections, delayed opening), reputational (loss of public trust, media coverage) and human (harm to people, exclusion of users with disabilities, exposure of personal information). Understanding them helps the project justify the cost of controls and choose the right level of effort.

One way to compare controls is expected exposure: the probability of a compliance failure multiplied by its consequence. The Compass team estimated that without a contract clause and verification of where the app vendor stored patron data, the chance of a reportable privacy breach over the app's first two years was about 6 %, with a consequence, including investigation, notification, remediation and reputational harm, of about $400,000. With the control, the probability fell to about 1.5 %. The expected exposure dropped from $24,000 to $6,000, which easily justified the modest cost of the clause and an annual verification. The figures were rough, but the comparison made the decision obvious.

Responding to a compliance gap

When a gap is found, the response depends on its seriousness and on who is accountable. The project manager's job is to make sure the gap is recorded, the right owner is informed, the consequences are assessed, options are developed and a decision is made at the right level. Serious gaps, such as a potential privacy breach or a safety violation, may require immediate action and notification under the organization's policies or the law; the project manager follows those procedures and involves the specialists at once rather than investigating quietly first.

In month 5 of the fit-out, the facilities manager discovered that the demolition subcontractor had started removing ceiling tiles in one area before the asbestos survey report had been formally accepted. The survey had in fact found no asbestos in that area, so no one was harmed, but the work had broken the project's own control. Priya stopped the work in that area, informed the sponsor and the health and safety lead, and the contractor was required to explain the breach. The team added a hold point to the subcontractor's work permits so that no demolition could start in any area without the survey sign-off, and the incident was recorded as a lesson learned.

Ethics and compliance

Compliance sometimes collides with pressure to deliver. A vendor may suggest skipping an audit because the product is "basically compliant"; a manager may hint that a failed test result should be reported as a pass; a deadline may tempt the team to open the branch before a final inspection. PMI's Code of Ethics asks project professionals to be honest in their reporting, to follow the law and the organization's policies, and to report unethical or illegal conduct to the appropriate people. On the exam, answers that hide, delay or misrepresent compliance problems are almost always wrong, however convenient they seem.

Sustainability as a compliance area

Sustainability now appears in the outline explicitly as a type of compliance requirement and as a source of risk. For many projects, sustainability obligations come from building or energy codes, environmental regulations, disclosure rules for larger companies, funding conditions and organizational policies. Measuring them may involve energy performance, waste diverted from landfill, embodied carbon in materials or the share of purchases meeting a green standard. For Compass, the library's green purchasing policy required low-emission finishes, and the municipality's climate plan asked capital projects to report waste diversion. The contractor tracked diversion weekly and reported 68 % of demolition waste diverted, above the 60 % target in the library's policy. Lesson 11 returns to sustainability as part of the external environment.

Audits and inspections

Compliance is often confirmed by people outside the project: building inspectors, auditors, regulators, accessibility experts or the organization's internal audit team. Their findings carry weight because they are independent. The project manager's role is to prepare for these reviews, not to manage their outcome. Preparation means knowing which reviews are required and when, having evidence organized and easy to find, making sure the right people are available, and leaving time in the schedule to correct findings.

On Compass, the fire inspection was scheduled with ten working days of float before the planned opening, because the facilities manager knew from experience that minor findings are common and correcting them takes time. The inspection found two issues, a missing sign and an emergency light that failed its test, both corrected within three days. The internal auditor's review of the procurement files found one quote that had been obtained by phone rather than in writing; the procurement officer obtained written confirmation and the purchasing procedure was clarified for future projects.

When findings arrive, they are recorded, assigned to owners and tracked to closure like any other compliance gap. Disputing a finding is sometimes appropriate, if the reviewer has misunderstood the facts, but it should be done openly through the proper channel, not by pressuring the reviewer.