CompTIA Project+ — Practice Questions and Mock Exam

Compliance auditing is a formal governance practice that verifies project activities adhere to external regulations (laws, industry standards) and internal policies (organizational procedures, security standards). In regulated industries like healthcare (HIPAA), finance (SOX, PCI-DSS), defense (CMMC), and data privacy (GDPR), compliance is not optional — violations can result in legal penalties, fines, and reputational damage. Compliance audits examine whether proper procedures are followed, required documentation exists, security controls are implemented, and regulatory requirements are met. They may be conducted internally by the organization's compliance team or externally by regulatory bodies or third-party auditors. The project manager must build compliance checkpoints into the project plan and ensure the team understands regulatory requirements. Agile retrospectives, velocity tracking, and Kanban WIP limits are project management practices but don't specifically address regulatory compliance. Exam tip: in regulated industries, compliance auditing is the governance mechanism that ensures legal and regulatory adherence.

Information radiators are a core Agile communication practice. The key principle is that important project information should be passively visible rather than requiring active effort to access. This reduces communication overhead and keeps everyone informed. Effective information radiators share several characteristics: they are large and visible, easy to understand at a glance, updated frequently, and located where the team works or passes regularly. Common examples include physical Kanban boards, digital dashboards on large monitors, burndown charts posted on walls, and CI/CD build status lights. The concept supports the Agile value of transparency and the principle that the most efficient method of conveying information is face-to-face conversation (or in this case, visual display). In virtual environments, information radiators may take the form of always-visible dashboard widgets or team status pages.

Risk transfer is one of the core negative risk response strategies, alongside avoid, mitigate, and accept (some frameworks also list escalate). When you transfer a risk, you shift the financial or operational consequences to a third party while retaining ownership of monitoring the risk. Insurance is the most common example — you pay a premium to transfer the financial impact of specific risks to an insurance company. Outsourcing is another form of transfer, where you contract a specialist vendor to handle a risky component, making them responsible for delivery. Performance bonds and warranties are additional transfer mechanisms. It's important to understand that transfer doesn't eliminate the risk; it reassigns who bears the impact. The cost of transferring (premiums, contract costs) should be weighed against the potential impact of the risk. Exam tip: if the question mentions insurance, outsourcing, or third-party contracts in the context of risk, transfer is often the answer, but check whether the action shifts the impact to the third party or mainly reduces probability or impact (mitigate) or removes the risk (avoid).