Management: Project, Service, Security, and Audit
Domain scope
The Management domain covers the processes that keep IT delivery predictable and auditable: project management, service management, security management, and system audit. FE questions ask you to interpret earned-value figures, classify incidents and changes, or select the correct control in a risk scenario. The exam rewards knowing the purpose of each process and the direction of each metric.
Core rules to know
- Project management: WBS, critical path (longest path, zero float), Gantt versus PERT, earned value management.
- EVM: PV is planned value, EV is earned value, AC is actual cost. CV = EV - AC; SV = EV - PV; CPI = EV/AC; SPI = EV/PV.
- Service management (ITIL): incident restores service; problem finds root cause; change is a controlled modification; release and deployment; SLA; service desk.
- Security management: CIA triad, risk = likelihood x impact, preventive/detective/corrective controls, ISMS and ISO/IEC 27001, business continuity with RTO and RPO.
- System audit: independence, evidence gathering, compliance versus substantive testing, audit trail.
Worked example
A task has PV = 100,000, EV = 80,000, and AC = 90,000. CV = 80,000 - 90,000 = -10,000, so the task is over budget. SV = 80,000 - 100,000 = -20,000, so it is behind schedule. CPI = 80,000 / 90,000 is approximately 0.89; SPI = 80,000 / 100,000 = 0.80. Both indices below 1 confirm that the task is behind schedule and spending more than the value earned.
Traps
- Reversing the CV and SV formulas, or reading a negative CV as under budget.
- Calling every user report a problem; an incident is the service interruption, while the problem is the underlying cause.
- Confusing RTO (maximum tolerable downtime) with RPO (maximum tolerable data loss).
- Treating an audit finding as an opinion rather than evidence-based nonconformity.