Management: Projects, Services, Risk, and Control
Management tests how IT work is planned, delivered, operated, controlled, and governed. It overlaps with project management, service management, risk, security governance, audit, and legal compliance.
Core rules and concepts
- Project constraints: scope, time, cost, and quality; a change to one affects the others.
- Planning tools: a WBS breaks deliverables into work packages; a Gantt chart shows schedule; PERT/CPM shows dependencies. The critical path is the longest path and has zero float.
- Earned value: CV = EV − AC; SV = EV − PV; CPI = EV/AC; SPI = EV/PV. Negative CV or SV and ratios below 1 are unfavorable.
- Service management: an incident restores service; a problem finds the root cause. Change management approves and schedules changes; an SLA defines service targets.
- Risk response: avoid, transfer, mitigate, accept; then monitor. Transfer, such as insurance, does not eliminate the risk.
- Continuity: RTO is the target recovery time; RPO is the tolerable data loss.
- Governance and control: least privilege, segregation of duties, audit trails, and an ISMS based on ISO/IEC 27001.
- Legal: software licenses, copyright, personal-data protection, and computer-crime law.
Worked example
A project reports PV = 100, EV = 90, AC = 110. CV = 90 − 110 = −20, so it is over budget. SV = 90 − 100 = −10, so it is behind schedule. CPI = 90/110 ≈ 0.82; SPI = 90/100 = 0.90. Both below 1 confirm the unfavorable position. The figures must be in the same currency unit; do not compare percentages across projects without checking the baseline.
Traps that cost marks
- Confusing incident with problem.
- Calling the critical path the shortest path.
- Reversing RTO and RPO.
- Treating risk transfer as risk elimination.
- Confusing mitigation (reduce probability or impact) with avoidance (remove the threat).
- Ignoring segregation of duties in internal-control questions.