PgMP Practice Question
Halfway through a three-year enterprise data-platform consolidation program, the program manager learns that a new data-privacy regulation will take effect twelve months earlier than expected. Preliminary analysis shows the regulation could increase ongoing operating costs by 20 percent if additional encryption and monitoring controls are required. The program's benefits realization plan currently assumes USD 15 million in annual savings from retiring legacy systems, and the sustainment plan shows payback in year two of operations. Key stakeholders include the CFO, the regional CIOs, and a privacy steering committee that meets quarterly. Several component projects are already in execution and contractual milestones are approaching.
Historically, the organization's governance policy requires any deviation greater than 10 percent in expected benefits or costs to be presented to the executive steering committee, and compliance-related risks are categorized as "high". Project managers have requested guidance because procurement of encryption appliances must begin within six weeks to avoid schedule slippage.
Under PMI's benefits management framework, which immediate action will best support analyzing and updating the benefits realization and sustainment plans in response to this emerging regulatory risk?
Escalate the cost increase to the sponsor and request contingency funding, leaving the benefits realization and sustainment plans unchanged until the annual benefits review
Facilitate a risk-benefit workshop with finance, IT security, and privacy representatives to quantify the regulation's impact, update the benefits register, adjust sustainment KPIs, and seek steering-committee approval of the revised plans
Direct each project manager to manage the regulatory risk in their individual projects while the program office continues to track benefits against the original baseline
Add the regulation as a high risk in the program risk register but defer any changes to benefits or sustainment documentation until after the projects implement the controls