Regulations

Key Points

• Mandatory sources such as laws, government regulations, industry codes, and binding directives.
• Captured as a curated, project-specific list with citations, applicability, and compliance obligations.
• Feeds Manage Quality Assurance to define audits, checklists, acceptance criteria, and evidence needed for compliance.
• Noncompliance risks include penalties, blocked releases, loss of certification, and reputational damage.

Purpose

Provide a clear, authoritative basis for quality assurance activities that enforce compliance. Translate obligations into process controls, verification points, and documentation requirements to ensure products and processes are acceptable to regulators and auditors.

How to Create

• Scope jurisdictions and domains: identify countries, states, industries, and regulators relevant to the project.
• Perform a regulatory scan using legal counsel, compliance teams, standards bodies, and subscription databases.
• Document a Regulations Register or Compliance Matrix with fields: source and citation, clause text or summary, applicability, risk level, required controls, evidence, owner, due dates, and status.
• Resolve interpretations with legal/compliance, record assumptions, and define acceptance criteria aligned to each obligation.
• Baseline the register, obtain approvals, and store it in a controlled repository with change control.

How to Use

• Convert obligations into quality checkpoints: audit questions, test cases, templates, and required approvals.
• Map each regulation to quality metrics, acceptance criteria, and deliverable verification activities.
• Plan and execute quality audits focused on high-risk clauses and required evidence retention.
• Embed compliance steps in procedures, workflows, and Definition of Done; train the team and suppliers.
• Include regulatory requirements in supplier contracts and incoming inspection criteria.
• Trigger change control and impact analysis when regulations change; update checklists and test suites accordingly.

Ownership & Update Cadence

• Primary owners: Compliance Officer or Legal Counsel for interpretation; Quality Manager for day-to-day application in QA activities.
• Contributors: Product Owner, Engineering Lead, Security/Privacy Officer, Procurement, and Suppliers.
• Cadence: initial baseline during planning, reviewed before phase gates and releases, and refreshed upon regulatory bulletins, scope changes, or entry into new jurisdictions.
• Monitoring: subscribe to regulator alerts and standards updates; log changes and communicate required process updates.

Example

A fintech project identifies PCI DSS, GDPR, and local consumer protection regulations as applicable. The team creates a compliance matrix mapping clauses to controls such as encryption standards, access logging, data retention, breach notification timelines, and evidence artifacts. Manage Quality Assurance uses the matrix to build audit checklists, add specific test cases for cardholder data handling, require secure coding reviews, and verify vendor contracts include PCI obligations before go-live.

PMP Example Question

While executing Manage Quality Assurance, the team identifies several applicable regulations. What should the quality manager do next?

1. Add the regulations to the risk register without changing quality activities.
2. Translate the regulations into acceptance criteria and audit checklists tied to required evidence.
3. Escalate to the sponsor to defer compliance until after product release.
4. Ignore industry standards if they are not explicitly referenced in the contract.

Correct Answer: B — Translate the regulations into acceptance criteria and audit checklists tied to required evidence.

Explanation: Regulations must be operationalized in QA activities. Converting them into criteria, checks, and evidence ensures the team verifies compliance during execution.