Business Environment — Risks, compliance, change & closure
Business synthesis module: risks, issues, compliance, controlled change, external environment, continuous improvement, transition, and clean closure.
Estimated time : 95 min
Learning objectives
- Distinguish risk, issue, assumption, and constraint.
- Apply change control in predictive and backlog handling in agile.
- Treat compliance, culture, and external environment as decision factors.
- Close cleanly: acceptance, transition, procurement, finance, resources, lessons learned.
Key concepts
- Risk
- Uncertain event that may affect objectives, value, compliance, or delivery.
- PMP ECO 2026 — Business Task 5
- Issue
- Event that has already occurred and requires action, owner, and tracking.
- PMP ECO 2026 — Business Task 4
- Compliance
- Adherence to regulatory, security, health, sustainability, policy, and contractual requirements.
- PMP ECO 2026 — Business Task 2
- Closure
- Formal validation, transition, procurement/finance/resource finalization, archiving, and lessons learned.
- PMP ECO 2026 — Process Task 10
1. Risks, issues, and responses
A common mistake is treating a real issue as a future risk. Once an event has occurred, it must be managed as an issue with immediate action.
| Element | Definition | Artifact |
|---|---|---|
| Risk | Future uncertainty | Risk register |
| Issue | Current real event | Issue log |
| Assumption | What is assumed true | Assumption log |
| Constraint | Limit imposed on the project | Plan / constraint log |
Risk responses
| Threat | Opportunity |
|---|---|
| Avoid, mitigate, transfer, accept, escalate | Exploit, enhance, share, accept, escalate |
Output
the app is delivered
Outcome
customers use it
Benefit
−20% support calls
Value
$2M saved/yr
Connect the risk response to value: an expensive response is healthy only if it better protects benefits or compliance.
Choosing a response with EMV
A vendor risk has 30% probability and would cost $80,000 if it occurs. A mitigation costs $10,000 and reduces probability to 10%.
- EMV without response: 30% × 80,000 = $24,000.
- Residual EMV after mitigation: 10% × 80,000 = $8,000.
- Total expected cost with mitigation: 8,000 + 10,000 = $18,000.
- Expected saving: 24,000 - 18,000 = $6,000.
The mitigation is economically defensible and should be documented with owner, threshold, and monitoring. If compliance is also at stake, the argument becomes even stronger.
Artifact → decision → PMI action map
Artifact
Risk register / issue log / change log / compliance checklist
Decision
Is it uncertain, already happened, requested, or mandatory?
PMI action
Classify correctly, assign an owner, decide through governance, and record.
Avoid: Treating compliance, issues, and changes as simple tasks.
Recommendations
- Assign owner, response, and threshold to each important risk.
- When a risk materializes, move it to issue and execute the response.
Tips
- May/might/could = risk; is/has happened = issue.
- Escalate a risk if the local owner lacks authority.
Chapter quiz
1.An undelivered external dependency is blocking two tasks today. How should it be treated?
2. Compliance and change control
Compliance is a decision threshold. If a legal, security, or sustainability requirement appears, the PM must analyze impact, propose options, and follow governance.
- Record the request or requirement.
- Analyze impact on scope, schedule, cost, quality, risk, value, and compliance.
- Submit to the appropriate decision level.
- Communicate request status.
- Update documents and implement only what is approved.
Speed trap
Implementing an unapproved change to go fast creates compliance, cost, and trust risk.
Artifact → decision → PMI action map
Artifact
Risk register / issue log / change log / compliance checklist
Decision
Is it uncertain, already happened, requested, or mandatory?
PMI action
Classify correctly, assign an owner, decide through governance, and record.
Avoid: Treating compliance, issues, and changes as simple tasks.
Recommendations
- Never bypass compliance to protect a local metric.
- Communicate the status of proposed changes even before approval.
Tips
- Approved change only = implement.
- Compliance issue = analyze consequences of non-compliance.
Chapter quiz
1.A new security law impacts the project. Which action is most correct?
3. Closure, transition, and continuous improvement
Closing does not simply mean stopping work. You must obtain acceptance, verify transition, finalize contracts and finances, release resources, and capture lessons learned.
PMP closure checklist
| Step | Purpose |
|---|---|
| Formal acceptance | Confirm the deliverable is accepted. |
| Operational transition | Ensure support, documentation, training, runbook. |
| Procurement and finance | Close contracts, invoices, holdbacks, reserves. |
| Lessons learned / OPA | Improve future practices. |
| Resource release | Release people cleanly. |
Continuous improvement
Lessons learned matter only if they update the organization's processes, templates, checklists, or training.
Artifact → decision → PMI action map
Artifact
Risk register / issue log / change log / compliance checklist
Decision
Is it uncertain, already happened, requested, or mandatory?
PMI action
Classify correctly, assign an owner, decide through governance, and record.
Avoid: Treating compliance, issues, and changes as simple tasks.
Recommendations
- Validate operations readiness before handover.
- Capture lessons throughout the project, not only at the end.
Tips
- Acceptance before administrative closure.
- Terminated project does not equal failed project if the decision is governed and documented.
Chapter quiz
1.The customer has not yet accepted the deliverable. Which action is premature?
Decision toolkit
PMP decision trees & running case
Use this when two answers look right: qualify the context, choose the artifact, then act.
Non-compliance
A regulatory, quality, safety, or ESG requirement is not met.
1. Non-compliance is suspected.
Decision: Verify facts and criteria.
Action: Compare requirements, evidence, and acceptance thresholds.
2. Non-compliance is confirmed.
Decision: Protect the organization and users.
Action: Document, correct, inform required parties, and control recurrence.
3. The sponsor pushes to deliver anyway.
Decision: Do not sacrifice compliance.
Action: Escalate through governance/ethics with impacts and obligations.
Trap: Business value does not authorize bypassing a regulatory obligation.
Resistant stakeholder
A key user rejects the solution, slows approvals, or blocks adoption.
1. Resistance comes from lack of understanding.
Decision: Adapt communication.
Action: Connect the change to their benefits, impacts, and expectations.
2. Resistance comes from a real business risk.
Decision: Do not treat it as personal opposition.
Action: Analyze the concern, update risks/requirements, and co-create the response.
3. Adoption remains low.
Decision: Strengthen the change management plan.
Action: Add training, champions, feedback loops, and adoption metrics.
Trap: Ignoring a resistant stakeholder often turns adoption risk into benefits failure.
Risk vs issue
An event may happen or has just happened.
1. The event is uncertain.
Decision: Treat it as a risk.
Action: Qualify probability/impact, choose response, owner, and reserve.
2. The event has occurred.
Decision: Treat it as an issue.
Action: Create corrective action, assign an owner, and track to closure.
3. The issue creates new risks.
Decision: Update both logs/registers.
Action: Issue log for immediate action, risk register for remaining uncertainty.
Trap: A materialized risk is no longer just monitored: action is required.
AI & sustainability project: energy optimization
Charter
Objective: reduce energy consumption by 12% with a responsible AI model.
Backlog / WBS
Hypotheses, experiment backlog, model card, ethical thresholds, controlled pilots.
Stakeholders
- ESG sponsor, data science, operations, IT, AI compliance, field users.
- Success measured by savings, adoption, explainability, and no negative HSE impact.
Risks
- Data bias, non-explainable model, operator rejection.
- Energy optimization that degrades quality or safety.
Change
Request: automate a critical decision. Response: assess risk, human control, compliance, and acceptability.
EVM
Connect model/deployment cost to measured benefits; include AI operating costs.
Closure
Model monitoring, operations handover, carbon/energy benefits tracking, responsible audit.
Practical examples
Risk became issue
Scenario : The critical vendor announces they will not deliver the expected component this week.
Project manager's action : Move to issue, activate the response plan, assess impacts, and communicate options.
Exam strategy
- Risk = uncertain; issue = real now.
- Mandatory compliance is not negotiated away for schedule convenience.
- A change must be communicated, approved according to context, and documented.
- Closure starts only after acceptance or a formal termination decision.
Module assessment
1.Which sequence is most aligned for a major predictive change?