PRIN-131 · Lesson 11 of 12 · 26 min

Tailoring these practices: agile, small projects, digital and data

PRIN-110 described tailoring as a principle: PRINCE2 is adapted to suit the project's environment, size, complexity, importance, capability and risk. Tailoring the control practices does not mean dropping them. A small project still needs to know what good looks like, what might go wrong, how changes are decided and whether it is on track. What changes is formality, frequency and the tools used. This lesson looks at tailoring quality, risk, issues and progress for small projects, agile delivery, projects within programs, commercial relationships and data-rich digital environments. PRIN-150 covers tailoring in depth and PRINCE2 Agile in particular.

What must stay, whatever the tailoring

Some elements of each practice are essential even on the smallest project, because without them the practice simply does not exist. Others can be scaled down or combined. The table below is our summary of a sensible minimum; the official manual sets out the minimum requirements for applying each practice.

A sensible minimum for each control practice, and what can be scaled (our summary).
PracticeKeep in every projectCan be scaled down or combined
QualityAgreed acceptance criteria; quality criteria for key products; evidence of checks and acceptanceFormal quality review meetings; separate quality register; long quality management approach
RiskIdentified risks with owners; a response for significant risks; a threshold for escalationDetailed scoring scales; separate risk register; Monte Carlo analysis
IssuesA record of issues needing decisions; a defined change authority; baselines changed only by decisionSeparate issue reports; multi-level change authority; product register detail
ProgressTolerances; regular reports to whoever authorized the work; escalation when tolerance is forecast to be exceededFrequency and length of reports; number of stages; earned value

Small projects

On a small project, such as replacing a community center's booking system over three months, the four practices can share a single page of approach and a single log. Quality might be a short list of acceptance criteria agreed with the center manager and a test checklist. Risks, issues and lessons can sit in one spreadsheet with a type column. The project manager might report weekly in a five-line email to the executive, with tolerances of two weeks and ten percent. These are real practices, just proportionate ones.

Tailoring the control practices for a large and a small project.
ElementLarge project (Ridgeline Water rollout)Small project (booking system)
Management approachesSeparate quality, risk and issue management approachesOne page covering all three
RegistersSeparate registers in the project tool, linkedOne combined log with a type column
Quality checksFactory tests, field tests, quality reviews with four rolesAcceptance test checklist run by two users
Change authorityThree levels with a change budgetProject manager up to a small limit; executive above
ReportsWeekly checkpoint, four-weekly highlight, end stage reportsWeekly email to the executive; short closure report
TolerancesSeven performance targets at three levelsTime, cost and scope at project level

Agile delivery

Many projects now deliver at least some products using agile methods. The control practices map onto agile practices naturally, but the emphasis shifts. In agile delivery, time and cost are usually fixed by timeboxes, while scope is the main area of flexibility. Quality is built in through acceptance criteria on each user story and a team definition of done, rather than inspected at the end. Risks are surfaced in daily stand-ups and retrospectives. Most changes are handled by reprioritizing the backlog within the agreed scope tolerance, with only changes beyond that tolerance going to the board.

How the control practices are expressed in agile delivery.
PracticeTypical agile expressionWhat the board still needs
QualityAcceptance criteria per story; definition of done; automated tests; sprint review demonstrationsProduct-level acceptance criteria; evidence that the definition of done is met
RiskRisks raised in stand-ups and retrospectives; risk-adjusted backlogEscalation of risks beyond risk tolerance; a view of overall exposure
IssuesBacklog reprioritization by the product owner within scope toleranceDecisions on changes beyond scope tolerance or affecting the business case
ProgressBurn-up or burn-down charts; velocity; sprint reviewsForecast of what will be delivered by the fixed date, against scope tolerance

The code below shows a typical agile progress forecast. Ridgeline Water's customer portal is built in two-week sprints with a fixed end date. The must-have features total 180 story points, and the scope tolerance allows should-have and could-have features to be dropped, but not must-haves. From the velocity of the sprints so far, the code forecasts how many points will be delivered by the end date and whether the must-haves are at risk.

A burn-up chart with sprints 0 to 12 on the horizontal axis and story points 0 to 300 on the vertical axis. Three dashed horizontal lines mark scope levels: must at 180, must plus should at 240 and all features at 280. A solid line rises from 0 to 116 points at sprint 5. Two dotted projections continue to sprint 12, one reaching 278 at mean velocity and one reaching 249 at the lowest velocity.
Burn-up chart for the customer portal: delivered points so far and two forecasts against the prioritized scope.
A burn-up forecast against prioritized scope with a fixed end date.
import statistics
velocities = [22, 26, 19, 24, 25]            # points per sprint so far
sprints_total, sprints_done = 12, len(velocities)
done = sum(velocities)
backlog = {"must": 180, "should": 60, "could": 40}
remaining_sprints = sprints_total - sprints_done
v_mean = statistics.mean(velocities)
v_low = min(velocities)
fc_mean = done + v_mean * remaining_sprints
fc_low = done + v_low * remaining_sprints
print(f"delivered so far {done} points; mean velocity {v_mean:.1f}")
print(f"forecast by end date: {fc_mean:.0f} points (mean), {fc_low:.0f} points (lowest velocity)")
cum = 0
for level, pts in backlog.items():
    cum += pts
    status = "safe" if fc_low >= cum else "at risk" if fc_mean >= cum else "unlikely"
    print(f"up to {level:6} {cum:3} points: {status}")
Output
delivered so far 116 points; mean velocity 23.2
forecast by end date: 278 points (mean), 249 points (lowest velocity)
up to must   180 points: safe
up to should 240 points: safe
up to could  280 points: unlikely

Five sprints have delivered 116 points, a mean velocity of 23.2. At that rate the team will deliver about 278 points by the end date, and even at its lowest velocity about 249. The must-haves and should-haves are safe even at the lowest velocity, but the full set of could-haves, which would need 280 points, is unlikely: even the mean forecast falls just short. In PRINCE2 terms, the project is within scope tolerance: the board's tolerance allows could-haves to be dropped. The product owner will decide which could-haves to keep, and no exception is needed. If the forecast showed must-haves at risk, scope tolerance would be threatened and the board would need to decide.

Projects within programs and commercial relationships

When a project is part of a program, the program usually sets some of the controls. Its risk management approach may define the scales the project must use; its change control may decide changes that affect other projects; and its reporting may require project highlight reports in a standard format. The project's approaches should refer to the program's rather than duplicating them. In a commercial relationship, the contract shapes the control practices: quality criteria may be contractual acceptance tests, transfer of risk is achieved through contract clauses, changes to scope are contract variations with their own procedure, and progress reports may be contractual deliverables. PRINCE2 7's commercial management approach is where these arrangements are described, and PRIN-120 discussed the customer–supplier relationship that underlies them.

Digital and data

PRINCE2 7 places more emphasis than earlier editions on the use of data and digital technology in project management. In practice this means that registers live in shared tools rather than documents, reports can be generated from live data rather than written, dashboards can show tolerance used in real time, and analysis such as Monte Carlo forecasting is within reach of ordinary projects. It also brings new responsibilities: data quality, version control of plans held in tools, access control, retention of project records and protection of any personal data in registers, such as names in issue logs or customer details in quality records. The digital and data management approach is where a project records how it will handle these.

Opportunities and risks of digital and data in the control practices.
OpportunityRisk to manageControl
Highlight reports generated from registersGarbage in, garbage out: stale statuses give false comfortWeekly register review; owners confirm their entries
Real-time dashboards for the boardBoard micromanages within delegated toleranceAgree that dashboards inform but decisions follow management by exception
Forecasting from historical dataModels trusted beyond their assumptionsState assumptions; compare forecasts with actuals at stage boundaries
AI assistants drafting reports and risk listsPlausible but wrong content; confidential data leaving the organizationHuman review of all outputs; approved tools only; no sensitive data in public tools
Shared registers across suppliersPersonal or commercially sensitive data exposedAccess controls; data minimization; agreed retention

Personal information in project records may be subject to privacy law. In the United States there is no single general federal privacy law; obligations come from sector laws, state consumer privacy laws such as California's, and public records and privacy rules for government bodies. A municipal utility, for example, must follow its state's public records and privacy requirements, which may also make some project records open to public request. Project registers that name customers or staff should follow the organization's rules on access and retention.

Worked problem

Tailoring for a hybrid project

Ridgeline Water's rollout combines predictive work (installing 57,000 meters across districts) with agile work (developing the customer portal in sprints). How should the control practices be tailored?

Show solution
  1. Quality: keep factory and field tests for meters with formal records; for the portal, use acceptance criteria per story and a definition of done, with a formal acceptance test before each release.
  2. Risk: one risk register for the whole project, with portal risks raised from sprint retrospectives by the product owner.
  3. Issues: formal change control for meter scope and installation; backlog reprioritization within scope tolerance for portal features, with changes beyond tolerance escalated.
  4. Progress: earned value on installation by district; burn-up charts for the portal; both summarized in one highlight report against stage tolerances.
  5. Record the tailoring in the project initiation documentation so that the board and assurance know what to expect.

Answer: The two kinds of work keep their natural controls, but they report into one set of stage tolerances, one risk register and one highlight report, so the board sees one project.

Recording tailoring decisions

Tailoring is a decision, and like any decision it should be recorded and approved. PRINCE2 expects the project initiation documentation to explain how the method has been tailored, so that the board, assurance and any auditor can see what the project has chosen to do and why. A short tailoring record is usually enough. It lists each practice, what has been simplified or adapted, the reason, and any compensating control. Recording tailoring has two benefits: it prevents tailoring from becoming an excuse for skipping work, and it gives the next similar project a starting point.

An extract from Ridgeline Water's tailoring record (illustrative).
PracticeTailoring decisionReasonCompensating control
QualitySingle-reviewer document reviews for low-risk productsSaves review meetings on routine lettersUser assurance samples 1 in 5 reviews
RiskCombined risk and issue log for the portal teamSmall agile team; one toolWeekly export to the project risk register for risks above tolerance
IssuesBacklog reprioritization within scope tolerance for portal featuresAgile delivery with a product ownerProduct owner reports scope changes in each highlight report
ProgressBurn-up charts instead of earned value for the portalEarned value adds little for timeboxed workBurn-up forecast compared with scope tolerance every sprint

Tailoring should also be revisited. A practice that was simplified at the start of the project may need more formality when the project grows, when an external supplier joins, or when a near-miss shows that a control was too light. Stage boundaries are the natural point to review the tailoring record alongside the next stage plan.

Common mistakes

  • MistakeDropping a practice on a small project.

    InsteadKeep the essentials of every practice and scale down formality.

  • MistakeTreating every backlog change in agile delivery as a formal request for change.

    InsteadLet the product owner reprioritize within scope tolerance; escalate only beyond it.

  • MistakeDuplicating a program's controls in each project.

    InsteadRefer to the program's approaches and adopt its scales and reporting.

  • MistakeAssuming dashboards make highlight reports unnecessary.

    InsteadDashboards inform; the project manager still interprets, forecasts and asks for guidance.

  • MistakePutting personal data into registers without considering privacy rules.

    InsteadMinimize personal data and follow the organization's privacy and retention rules.

Summary and key terms

  • Tailoring adjusts formality, frequency and tools; it does not remove practices.
  • Small projects can combine approaches and registers into one page and one log.
  • In agile delivery, time and cost are fixed and scope is the main tolerance; quality is built in through acceptance criteria and a definition of done.
  • Backlog reprioritization handles most agile changes within scope tolerance.
  • Programs and contracts shape a project's controls; refer to them rather than duplicating them.
  • PRINCE2 7 emphasizes data and digital tools, recorded in the digital and data management approach.
  • Digital tools bring data quality, privacy and over-reliance risks that must be managed.
Tailoring
Adapting PRINCE2 to suit the project's context, size, complexity and risk.
Definition of done
A team's shared list of conditions a product must meet to be considered complete.
Velocity
The amount of work an agile team completes per timebox, often in story points.
Burn-up chart
A chart showing cumulative work completed against total scope over time.
Product owner
In agile delivery, the person who prioritizes the backlog on behalf of users.
Commercial management approach
In PRINCE2 7, the description of how commercial relationships will be managed.
Scope tolerance
The permissible variation in what is delivered, often expressed through priorities.

Practice problems

Work each problem on paper first, then reveal the answer to check.

  1. Does tailoring allow a small project to skip risk management?

    Show answer

    No; it can scale it down, but risks, owners and escalation are still needed.

  2. In agile delivery, which performance target usually carries most of the flexibility?

    Show answer

    Scope.

  3. How is quality usually built in on agile teams?

    Show answer

    Acceptance criteria on stories, a definition of done and automated tests.

  4. Who reprioritizes the backlog within scope tolerance?

    Show answer

    The product owner.

  5. When does an agile scope change need the board?

    Show answer

    When it would exceed scope tolerance or affect the business case.

  6. Velocities of 20, 24 and 22 with 6 sprints left: forecast additional points at mean velocity?

    Show answer

    About 132 points.

  7. What should a project in a program do about risk scales?

    Show answer

    Use the program's scales rather than inventing its own.

  8. Where are contract change procedures described in PRINCE2 7?

    Show answer

    In the commercial management approach.

  9. Name one risk of AI tools in project reporting.

    Show answer

    Plausible but wrong content, or confidential data leaving the organization.

  10. Where does a project describe how it will use data and digital tools?

    Show answer

    In the digital and data management approach.

Lesson quiz · 5 questions

Score 60% or more to complete this lesson.

Take the quiz