Earned value, a mandatory patch and a request to cut testing
You are managing a 20-week platform upgrade with a budget at completion (BAC) of £800,000. At the end of week 8, planned value (PV) is £320,000, earned value (EV) is £260,000, and actual cost (AC) is £300,000. The team has completed 13 of 40 work packages. A mandatory security patch has just been issued; it will add an estimated 60 person-days and is not in the baseline. The vendor's latest invoice includes £25,000 for work that your team has not yet accepted. The sponsor asks whether the project will finish on budget and whether penetration testing can be descoped to recover schedule. Your test lead says penetration testing is the only control that will evidence a regulatory requirement. The change control board meets next week. What do you do?
1. Calculate SPI, CPI, EAC and TCPI from the data given. Interpret what they mean and state the cautions that limit their reliability.
Read the worked answer
Calculations:
- SPI = EV / PV = 260,000 / 320,000 = 0.81.
- CPI = EV / AC = 260,000 / 300,000 = 0.87.
- EAC = BAC / CPI = 800,000 / 0.87 = approximately £923,000 (using exact CPI: £923,077).
- TCPI = (BAC - EV) / (BAC - AC) = (800,000 - 260,000) / (800,000 - 300,000) = 540,000 / 500,000 = 1.08.
Interpretation: the project is behind schedule and over budget. It has earned 32.5% of the budget while 40% of the work was planned. The current forecast is a negative variance of about £123,000. The remaining work must be delivered at about 8% better cost efficiency than the original plan just to meet the BAC.
Cautions:
- EV may be overstated or understated if the 13 of 40 work packages are not measured consistently. Check the completion criteria.
- AC includes £25,000 of unaccepted vendor work. If that invoice is rejected, AC becomes £275,000 and CPI improves to about 0.95, giving EAC of about £845,000. The forecast is sensitive to invoice validation.
- The 60-person-day patch is not in any of these figures. It will worsen the forecast once estimated.
- SPI on its own does not prove critical-path delay; check milestone and dependency data.
So the answer to the sponsor is: on current data, no, the project is not forecast to finish on budget.
2. The sponsor asks whether to descope penetration testing to recover schedule. Formulate your recommendation and the decision process.
Read the worked answer
Recommendation: do not descope penetration testing. The test lead says it is the only evidence for a regulatory requirement. Cutting it converts a schedule problem into a compliance and security risk, and the saving is likely smaller than the cost of a failed audit or a production vulnerability.
Decision process:
- Quantify the schedule benefit. How many days would descoping actually recover, and does that change the critical path? If not, the trade is pointless.
- Quantify the risk. Identify the regulatory requirement, the evidence expected and the consequence of absence. Record the risk owner.
- Find better options. Descope lower-value reporting, phase non-critical interfaces, add a specialist tester, or crash only activities with float. Present these before touching a control.
- Use change control. Submit the patch and any scope change to the CCB with cost, schedule and risk impact. If the sponsor still directs descoping, require written risk acceptance and record it in the decision log.
- Handle the invoice separately. Do not pay for unaccepted work. Validate it, adjust AC, and ask the vendor for acceptance evidence. Keep the commercial issue out of the technical baseline argument.
A sponsor can accept risk; the PM must ensure the acceptance is informed and documented.