about 3.3% of the exam content - about 90 minutes - 14 practice questions
0:00 / --:--
Reading
Compliance means the project follows every rule that applies to it: laws, regulations,
contract terms, funder conditions, internal policies, safety codes, and privacy obligations. For a construction
manager this is familiar territory under different words: you already know that a permit, a lead-safe
certification, and a Davis-Bacon wage sheet are not optional. PMI's contribution is a repeatable process for
finding those requirements, planning for them, verifying them, and handling violations.
The exam treats compliance seriously. It is one of the few areas where stopping work and
escalating immediately are correct answers rather than avoidance.
When non-compliance creates a risk of harm or of the violation worsening, the activity is
stopped first, before facts are fully gathered, and only then does the sequence move through fact-finding, notification, correction, and
updating the project's records.
Classifying compliance requirements
Before you can plan for compliance you have to know what kind of requirement you are dealing with, because
the source determines who enforces it and what happens when it is broken.
Category
Source
GCHS example
Consequence of violation
Regulatory / legal
Government statute or rule
EPA Renovation, Repair and Painting lead-safe rule; ADA accessibility standards; local building code
Loss of funding eligibility, reporting failure, reputational harm
Finding requirements before they find you
Compliance identification is a planning activity, not a discovery you make during an inspection. The PM
should:
Review the contract, grant agreement, and charter for stated obligations, reporting
duties, and audit rights.
Consult subject matter experts: legal counsel, the compliance officer, the safety
manager, the funder's program representative. PMI expects the PM to consult experts rather than interpret
regulation alone.
Research applicable jurisdictional rules: the same rehab scope carries different
requirements in a coastal windstorm zone than inland.
Record requirements in the requirements documentation and traceability matrix so each one
traces to a deliverable and a verification method.
Analyze the consequences of non-compliance and record the exposure in the risk
register, with owners and responses.
Build compliance into the plan: schedule activities, budget cost, assign responsibility,
and define quality metrics and audits.
Key points
Compliance costs belong in the budget and compliance activities belong in the schedule. An answer choice that
treats a required inspection, certification, training, or report as unplanned overhead is almost always the wrong
answer. Planned compliance is cheap; discovered non-compliance is expensive.
Verifying compliance: audits, inspections, and metrics
Quality audits: structured, independent reviews confirming the project follows policies
and processes. Audits examine process; inspections examine product.
Inspections and testing: third-party or authority-having-jurisdiction verification of the
deliverable itself.
Checklists and compliance registers: a running list of requirements with status and
evidence.
Compliance metrics and thresholds: for example, percent of subcontractors with current
insurance certificates, or number of open safety observations. A threshold that is crossed should trigger a
defined response, not a debate.
Documentation and records retention: for funded programs, the file is the
compliance. If the required work was performed but not documented, an auditor will treat it as not performed.
When non-compliance happens
This is the highest-yield exam scenario in the domain. The general sequence:
Stop the unsafe or non-compliant activity if there is any risk of harm or of worsening the
violation. Safety first, always.
Determine the facts and the root cause: what happened, what requirement it breached, how
far it extends.
Notify the required parties: compliance officer, legal, sponsor, and where the rule
requires it, the regulator or funder. Some violations carry a legally mandated reporting deadline.
Contain and correct: remediate the specific instance, then apply corrective action to
stop recurrence.
Update the risk register, issue log, and lessons learned, and adjust the plan or process
that allowed it.
Escalation is correct here
PMI usually rewards acting over escalating. Compliance is a well-known exception. If a violation is a legal
breach, a safety hazard, a fraud indicator, or an ethics violation, the correct exam answer is to stop the
activity and report it through the proper channel immediately, even if a stakeholder, a sponsor, or a
customer asks you not to. You do not negotiate a legal requirement, and you do not conceal a violation to protect
a schedule.
Watch also for the ethics dimension. PMI's Code of Ethics and Professional Conduct requires responsibility,
respect, fairness, and honesty. Accepting a gift from a bidder, allowing an undisclosed conflict of interest, or
signing off on work that was not done are all compliance failures the exam will test through realistic-sounding
scenarios.
Data privacy and AI-era compliance
Housing programs collect deeply personal information: income, disability status, medical need, household
composition. The compliance obligations that follow are practical:
Collect only the data the program actually requires, and keep it only as long as required.
Restrict access to those who need it; do not email client documentation to the whole crew thread.
Get consent before using client photos, names, or stories in reporting or promotion.
Do not enter personal data into unapproved tools, including AI assistants. Vendor terms may allow the tool
to retain or train on submitted content, which can itself be the breach.
Know your breach notification duties in advance, because notification deadlines are set by law or contract and can be short.
Compliance across delivery approaches
Agile teams carry the same obligations. The differences are mechanical, not substantive:
Compliance requirements can be written as backlog items or as constraints in the definition of
done, so no increment is "done" until it satisfies them.
Regulated work often uses a hybrid model: iterate on design, but pass mandated gates for permitting,
environmental review, and inspection.
Some agile environments maintain a compliance backlog or a standing non-functional
requirement set reviewed each iteration.
Continuous compliance, verifying a little every iteration, beats a single audit
scramble at the end, which is the point of building it into the definition of done.
Practice Questions
1. A crew member reports that a subcontractor removed painted trim from a 1958 home without lead-safe containment. What should the project manager do FIRST?
Ask the subcontractor to be more careful next time
Note it in the lessons learned register
Stop the work immediately and secure the area
Finish the day and address it at the weekly meeting
Answer: c. A live regulatory and health hazard requires stopping work and containing it before anything else. Documenting or discussing later allows continued exposure and worsens the violation.
2. Which of the following BEST distinguishes a quality audit from an inspection?
There is no meaningful difference
An audit measures cost performance against the budget; an inspection measures schedule performance against the baseline
An audit is done by the project team on itself; an inspection is done by the customer at final acceptance
An audit examines the process; an inspection examines the product
Answer: d. Audits are structured reviews of whether processes and policies are being followed; inspections verify that a deliverable itself meets requirements. Confusing the two leads teams to think a passing inspection proves process compliance.
3. A grant agreement between GCHS and a private foundation requires quarterly outcome reports and photo documentation of each finished unit. Which compliance category is this?
Regulatory
Voluntary best practice
Internal policy
Contractual
Answer: d. Obligations created by a signed grant agreement between parties are contractual, enforceable through breach and clawback remedies. Regulatory requirements come from statute or rule rather than from an agreement you signed.
4. When should compliance requirements be identified on a project?
Only if a stakeholder or funder representative raises them in writing
During planning, before execution begins
When an inspector arrives on site and cites the first violation
At project closure, when the compliance file is assembled for audit
Answer: b. Compliance identification is a planning activity so requirements can be scheduled, budgeted, assigned, and verified. Waiting for an inspector converts a planned cost into a violation and rework.
5. A sponsor asks the project manager not to report a documented safety violation because it would delay the funding draw. What should the PM do?
Ask the team to vote on it
Follow the sponsor's direction since the sponsor has authority
Report the violation through the required channel and document the request
Delay reporting until after the draw clears
Answer: c. Legally required reporting is not subject to stakeholder preference, and concealing a violation is an ethics breach. Sponsor authority covers project decisions, not exemption from law.
6. Which of the following is NOT a typical consequence of non-compliance with a regulatory requirement?
Automatic scope increase approval
Loss of license or of eligibility for future funding
Fines and penalties assessed by the regulator
Stop-work orders issued by the authority having jurisdiction
Answer: a. Non-compliance produces penalties, shutdowns, and loss of standing, never an automatic approval of anything. The other three are standard regulatory consequences.
7. A GCHS estimator skips the organization's own three-bid rule to save time on a small purchase. Which compliance category does this violate?
Internal policy, since GCHS's own procurement rule created the obligation
Regulatory, since it comes from a government statute that sets competitive bidding thresholds for nonprofits
Contractual, since it comes from a signed agreement
Health and safety
Answer: a. A three-bid rule is created by the organization itself, which makes it an internal policy requirement, enforced through discipline and audit findings rather than statute or contract. Regulatory and contractual requirements originate outside the organization.
8. When identifying which compliance requirements apply to a new GCHS rehab, what does PMI expect the project manager to do?
Delegate the entire question to the crew lead
Interpret the applicable regulations directly, without outside input
Consult subject matter experts such as legal counsel, the compliance officer, the safety manager, or the funder's program representative
Wait for an inspector to identify the requirements during a site visit
Answer: c. PMI expects the project manager to consult subject matter experts rather than interpret regulation alone, since compliance identification is a planning activity that draws on specialized knowledge. Waiting for an inspector converts a planned requirement into a discovered violation.
9. Why does a project manager record compliance requirements in the requirements documentation and traceability matrix?
To assign blame after a violation occurs
So each requirement traces to a specific deliverable and a verification method
To replace the risk register entirely once each requirement has a planned verification method
To track only the project budget
Answer: b. The traceability matrix links each requirement to the deliverable it affects and the method used to verify it, which is what makes compliance provable rather than assumed. It complements the risk register rather than replacing it, since consequences of non-compliance are recorded there separately.
10. A compliance metric, such as percent of subcontractors with current insurance certificates, crosses a defined threshold. What should happen?
The threshold is quietly lowered so it is no longer crossed
The threshold triggers the defined response already specified for it
The team debates whether the threshold is fair before acting
The finding is set aside until the next scheduled audit
Answer: b. A compliance threshold is set precisely so that crossing it triggers a defined response rather than a debate; the plan already says what happens next. Lowering the threshold or waiting for the next audit both defeat the purpose of monitoring it in real time.
11. Lead-safe work practices were actually followed on a unit, but the required compliance records were never filed. How will an auditor treat this?
As acceptable, as long as no auditor or funder representative specifically asks about it
As satisfied by the crew lead's verbal confirmation that the work was done correctly
As if the lead-safe work practices were not performed at all
As fully compliant, since the work itself was completed
Answer: c. For funded programs, the file is the compliance: if the work was performed but not documented, an auditor treats it as not performed. This is why documentation and records retention are listed as a verification method in their own right, not an afterthought to the work.
12. A bidder on a GCHS procurement offers the project manager a personal gift during vendor selection. What should the project manager do?
Accept the gift but tell no one about it
Ask the bidder to offer something smaller instead
Accept the gift quietly since it is a minor gesture
Decline the gift and disclose the offer, consistent with PMI's Code of Ethics requirement of honesty and fairness
Answer: d. Accepting an undisclosed gift from a bidder during procurement is exactly the kind of conflict of interest the Code of Ethics and Professional Conduct is written to prevent, so the correct response is to decline it and disclose the offer. Concealing it, in any amount, is the ethics failure the exam is testing for.
13. How do agile teams typically build compliance requirements into their delivery process?
Compliance requirements become backlog items or part of the definition of done, so no increment is complete without them
Compliance requirements are handled entirely by a separate compliance team outside the backlog, which reviews the product after release
Agile teams are exempt from compliance requirements
Compliance is addressed only in a single audit at the very end of the release
Answer: a. Writing compliance into the backlog or the definition of done makes verification continuous, checked every iteration rather than scrambled at a single end-of-release audit. Continuous compliance is the point; nothing about agile delivery exempts a team from the underlying obligations.
14. Before including a homeowner's photo in a funder progress report, what must the project manager obtain?
Nothing, since it documents a successful project outcome and the funder already owns the program records
Consent only if the homeowner is a minor
No formal step is needed unless the homeowner objects afterward
The homeowner's consent before using their photo, name, or story in reporting or promotion
Answer: d. Data privacy obligations require consent before using client photos, names, or stories, obtained in advance rather than assumed from silence. Housing programs handle deeply personal information, and consent is a planned step, not a courtesy extended after the fact.
Glossary
Compliance
Following every rule that applies to a project: laws, regulations, contract terms, funder conditions, internal policy, safety codes, and privacy obligations.
Quality audit
A structured, independent review confirming a project follows its policies and processes.
Inspection
Third-party or authority-having-jurisdiction verification of the deliverable itself.
Compliance threshold
A defined variance or metric level that, once crossed, triggers a specified response rather than a debate.
Requirements traceability matrix
A record linking each requirement to the deliverable it affects and the method used to verify it.
Code of Ethics and Professional Conduct
PMI's standard requiring responsibility, respect, fairness, and honesty in professional conduct.
Definition of done
The agreed conditions, which can include compliance requirements, that an increment must satisfy before it counts as complete.
Breach notification duty
A legally mandated deadline for disclosing a data privacy or security incident to affected parties or regulators.