Risk, Quality, and Regulatory Compliance
Domain 4 tests how risk is identified, scored, owned, and answered, and how quality and code compliance are planned and evidenced. For security systems, quality includes cybersecurity and privacy, not only physical workmanship.
Risk management
- Register fields: ID, description written as cause-event-effect, category, probability, impact, score, named owner, response, trigger, residual risk.
- Score with a defined scale (probability × impact). A 4×3 and a 3×4 score the same but may warrant different responses.
- Threat responses: avoid, mitigate, transfer, accept, escalate. Opportunity responses: exploit, enhance, share, accept.
- The PM owns the risk process; each risk has an individual owner who is accountable for the response.
Quality and compliance
- Quality planning sets standards and acceptance criteria. Quality assurance is process-focused (are we following the method and spec?); quality control is product-focused (does the door hold, does the camera resolve the plate?).
- Commissioning and acceptance testing - functional, integrated, failover, cybersecurity - produce documented evidence. The AHJ may require permits, inspections, and code compliance: egress rules such as NFPA 101, fire-alarm interface requirements, accessibility reach ranges and opening force.
- Security devices are network endpoints: hardening, unique credentials, firmware currency, segmentation, logging, and a privacy impact assessment for video and biometric data.
Worked example
Risk R-07: the specified camera model has a lead time beyond 12 weeks and will delay head-end commissioning. Probability 4, impact 4, score 16 (high). Transfer is weak because the integrator does not control the manufacturer; the chosen response is mitigate - pre-order before contract award and name an approved equal in the specification - with an accepted fallback of a reduced-scope phase 1. Residual risk after response: 2×4 = 8 (medium). Trigger: lead time confirmed above 8 weeks at submittal. Separately, the acceptance test must state the measurement, for example resolving a license plate at the gate at night, not merely that the camera is online.
Traps
- A risk register with scores but no owners and no triggers.
- Treating AHJ inspection as optional or scheduling it after occupancy.
- Using quality assurance and quality control interchangeably in status reports.
- Accepting a system with vendor default credentials, or omitting the privacy assessment.