Regulatory and Compliance Requirements
Compliance questions test whether you can identify obligations, prove you met them, and manage change when they move.
Core rules
- Hierarchy: law and regulation are mandatory and externally enforced; standards are often voluntary unless incorporated into a contract; policy is internally mandatory; procedure describes how you comply.
- Build an obligations register: requirement, source, owner, affected deliverables, evidence, due date, review frequency.
- Map obligations to the work breakdown and to acceptance criteria. A requirement with no test is a requirement with no proof.
- Common areas: data protection and privacy, health and safety, environmental permits, financial controls and segregation of duties, procurement and supplier flow-down clauses, records retention.
- Compliance is not a phase. Obligations enter through design, procurement, execution, and closure, and changed regulation is a change request with impact assessment.
- Evidence beats assertion: audits test records, not intentions.
Worked example
A project processes customer personal data. Reasoning: identify the lawful basis, retention period, breach-notification window, and cross-border transfer rules; assign each to an owner; add acceptance criteria and an audit date. If the retention rule changes mid-project, raise a change request, assess cost and schedule impact, update the register and the design, and re-baseline.
Traps
- Treating an internal policy as law, or a law as optional guidance.
- Assuming one legal review at kickoff covers the whole project.
- Missing supplier and subcontractor flow-down obligations.
- Declaring compliance with no retained evidence.