Ruankao Information System Project Manager (Senior) cheat sheet

Decompose actual scope and trace requirements to acceptance evidence.

Critical-path and float calculations require stated network assumptions.

CPI=EV/AC and SPI=EV/PV under the supplied earned-value model.

Choose forecast assumptions and authorization paths explicitly.

Quality = meeting requirements; grade = feature category. Low grade is acceptable, low quality is not.

Managing quality is process-focused; controlling quality inspects deliverables.

Pareto chart prioritises the vital few causes.

Control limits differ from specifications; use the stated chart and run-rule procedure to investigate signals.

External failure can be costly, but compare actual consequences rather than assume one universal ordering.

RACI: exactly one accountable owner per activity.

Tuckman: forming, storming, norming, performing, adjourning.

Herzberg: pay and conditions are hygiene factors; achievement and recognition motivate.

Channels = N(N−1)/2 with N including the project manager.

Collaborate/problem-solve is the preferred conflict approach when time allows.

Risk has cause, event, and impact; an issue has already occurred.

Delphi is anonymous and multi-round, used to reach consensus among experts.

Threat responses: escalate, avoid, transfer, mitigate, accept.

Transfer shifts financial impact but does not remove the risk.

EMV = sum of probability × impact, minus investment for the decision.

FFP fits clear scope and transfers cost risk to the seller.

CPFF, CPIF, CPAF place cost risk on the buyer and require cost auditing.

T&M suits urgent or undefined work and needs a ceiling.

RFP asks for a solution plus price; RFQ asks for price.

FPIF settlement must respect the ceiling price.

Use the four-move answer: name the process, cite the evidence, state the consequence, give remedy plus prevention.

Quote formal terminology such as integrated change control, CCB, traceability matrix.

Always show calculation steps for SPI, CPI, EAC, and float.

Every diagnosis must be tied to a specific fact in the scenario.

Pair each corrective action with a preventive control.

Keep owner, contractor and supervisor responsibilities distinct.

Trace requirements to actual test and acceptance evidence.

A supervisor’s observation does not automatically approve a scope change.

Record independence, unresolved exceptions and the limits of sampling.

Trace observable quality criteria to design and verification evidence.

DFD, ER and UML views answer different questions.

Choose architectural styles from constraints, not product fashion.

Separate verification against specification from validation for actual use.

CIA triad plus authenticity, non-repudiation and accountability define what is protected.

Risk combines threat, vulnerability and business impact; a vulnerability alone is not a risk.

Bell-LaPadula: no read up, no write down - confidentiality.

Biba: no read down, no write up - integrity.

Governance decides acceptable risk and accountability; management decides how to achieve it

Risk appetite (board-approved) differs from tolerance (variation) and capacity (maximum bearable)

Three Lines Model: internal audit must remain independent of control ownership

Check feasibility and model assumptions before optimizing.

A linear program can have several optimal solutions; integrality changes the problem.

Series and parallel availability formulas need explicit independence and success conditions.

Read averages, percentages, percentiles and normative terms in their actual context.