September 6, 2026 · 8 min read
TL;DR: Compliance questions test the order of your actions, not your knowledge of any particular law. The keyed answer is usually the step that establishes what the requirement actually demands: a gap analysis, an impact assessment, a legal review, a specialist's opinion. Acting before that measurement, in either direction, is the wrong answer whether the action is stopping the project or fixing it.
A cyber-security standard gets revised mid-build and the deliverable will not meet it. One of the four options is to stop the work. It sounds like the answer integrity demands, and it is wrong.
The cycle, not the ruling. One bank record lays out five steps in order: identify every requirement that applies, classify each one and decide how it will be met, build the controls into the plan and the work, monitor and audit as the work proceeds, then report the results and correct non-conformance.
That ordering matters more than it looks. Identification comes first because the common compliance failure is not breaking a rule, it is never having found the rule: a data-protection law in a second country, an accessibility standard, a permit with a twelve-week lead time. Classification is its own step because requirements differ in consequence. One carries a fine, another carries criminal liability, a third carries a delay, and each earns a different amount of control.
One thing sits outside that cycle. Whether a design infringes a patent, whether a regulation applies, whether an exceedance is material: those are specialist judgements. In 12 of the 65 multiple-choice records here, the keyed answer routes the judgement to someone qualified. The distractor has the project manager making the call alone.
Because the stem almost always gives you a gap of unknown size, and everything you might do next depends on that size. A cyber-security shortfall could be four configuration changes or a redesign. Until someone measures it, every action is a guess with a budget attached.
The counts across this slice are lopsided. Of the 65 multiple-choice compliance records, 27 key an answer that finds something out first: a gap analysis, an environmental impact assessment, a legal review, a specialist's opinion, a comparison against the standard's own checklist. Twenty records offer a distractor written in the language of immediate action, meaning implement now, change the design straight away, proceed as planned. Only 4 keyed answers use that language at all.
| The stem gives you | Keyed | Not keyed |
|---|---|---|
| A modelled exceedance of an environmental limit | Quantify it with a proper assessment | Redesign to reduce impact, or apply for an exemption |
| A revised standard the build will not meet | Analyse the gap between deliverable and standard | Start remediating, or stop until stakeholders respond |
| A new regulation nobody on the team understands | Get a legal review of what it requires | Work to the current plan, or redesign around an assumption |
| A standard the plan never considered | Re-evaluate the project against it and scope the change | Request budget for unscoped remediation |
| A specialist judgement (patent, data protection) | Consult the expert whose opinion a regulator expects | Change the design on suspicion |
Common trap: treating "halt the project" as the responsible answer. In these 65 records, halting, suspending, pausing, or ceasing work appears in 7 as a distractor and in exactly none as a keyed answer. The explanations give the same reason each time: stopping is a response sized to the worst case, chosen before anyone has established that the worst case is what you have. A drone-delivery pilot hits new airspace rules and the halt option is there. A hydroelectric project finds an unaddressed effect on fish populations and the halt option is there. Both key an assessment instead. This bank names that reflex in its explanations, so a wrong pick comes back explained rather than just marked.
The second reflex the bank punishes is telling the stakeholders and asking what they think. Ten records carry a distractor of that shape. Exactly one keys it, and that one is specific: a regulatory requirement was left out of a signed contract, disclosure is itself the obligation under PMI's ethics rules, and delay makes it worse. Everywhere else, going to stakeholders without a measurement hands them the same question you were asked, minus any information.
When a legal obligation and a funding decision genuinely conflict and you have no authority to settle it. That is one record out of 65, and the stem is built so the conflict cannot be resolved at the project level.
The scenario is worth walking through because it shows how narrow the exception is. A privacy impact assessment is legally required before a consumer-lending app can go live, and it has been fully quantified: scope, schedule, cost. The project manager raised it as a change request. The sponsor declines to fund it, citing program budget constraints. The legal obligation stands regardless.
Every ingredient that usually makes escalation wrong has been removed. The requirement is known, so there is nothing left to assess. The cost is quantified, so there is nothing left to estimate. The project manager already tried the normal route and it failed. What remains is a binding call between a compliance exposure and a budget constraint, and that call belongs to a governance body, not to the project manager. Proceeding without the assessment ships in violation of a stated legal requirement. Cutting scope elsewhere funds it by a decision the project manager has no standing to make. Halting until the sponsor reverses is, again, not on the list.
Most compliance stems are not built that way. They hand you something unmeasured, which means a useful next step exists and it is yours to take. Escalation earns its place only after you have taken every step you can and the decision that remains sits above you.
Fewer questions than the topic name suggests, and they test timing rather than procedure. Nine of the 65 records involve a permit or a licence and 4 involve an audit, and in almost all of them the keyed answer is the one that acts while acting is still cheap.
A food-safety scheme certificate is decided by what an auditor watches happening on the day, so the keyed answer stages a rehearsal inspection against the scheme's own checklist, with the line running, eight weeks out, while every finding still costs only the fix. Practising answers coaches what the auditor hears instead of producing a finding.
A sustainability certificate is awarded on documented provenance for each material, so the keyed answer captures provenance as each delivery is accepted rather than assembling a pack at handover. Evidence about a moment can only be gathered at that moment. The same logic drives a dredging scenario where the baseline seabed survey has to happen in the two weeks before the first cut, because the condition being measured stops existing the day the plume spreads.
Permits also outlive the project. One record closes a project that built an effluent plant whose permit carries continuing duties, quarterly sampling and an annual return, and the keyed answer is agreeing with operations who performs them and confirming they are resourced. Adding the conditions to a manual documents an obligation without assigning it to anyone.
What is a project manager responsible for on compliance? Finding the requirements, classifying them, building controls into the plan and the work, monitoring, and reporting. Interpreting the law is not on that list; consulting the person who can is.
Should you stop the project when you find a compliance gap? Almost never. Halting shows up in 7 of these 65 records as a wrong answer and in none as a keyed one. A gap of unknown size does not justify a response of maximum size.
Is compliance risk different from other project risk? Yes. Ordinary risk lands on the project as cost or delay. Compliance risk reaches past it: fines on the organization, a lost operating licence, personal liability. That is why it goes to governance.
Why does compliance matter more under the 2026 ECO? Business Environment moved from 8 percent to 26 percent of the exam, and compliance is Task 2 inside it. The task stayed where it was; its weight roughly tripled.
The 66 compliance questions in PMP Practice sit inside a bank of 2,141 re-certified against PMBOK 8 and the July 2026 Exam Content Outline, and every wrong answer carries the reasoning that makes it wrong, explained rather than just marked. Start the free 20-question sample with no card and no signup.
Related: Business Environment tripled in weight · Project governance: who decides what · Business environment study guide
Sources: PMI — PMP Examination Content Outline, 2026 (PDF) · PMI — PMBOK Guide standards
What is a project manager responsible for on compliance?
Finding every requirement that applies, deciding how each one will be met, building those controls into the schedule and the acceptance criteria, checking they hold, and reporting what the checks find. The project manager is not responsible for interpreting the law. That belongs to counsel or a compliance specialist, and 12 of the 65 multiple-choice records in this bank key an answer that goes to one.
Should you stop the project when you find a compliance gap?
Almost never on the exam. Halting appears in 7 of these records as a wrong answer and in none as a keyed one. A gap of unknown size does not justify a response of maximum size, and stopping costs schedule without producing the one thing you are missing, which is the measurement of how big the gap is.
Is compliance risk different from other project risk?
Yes, and one bank question tests exactly that. Ordinary risk lands on the project as cost, delay, or a deliverable that underperforms. Compliance risk escapes the project: fines against the organization, a lost operating licence, personal liability for individuals. That is why it is reported to governance rather than managed inside the project alone.
Why does compliance matter more under the 2026 ECO?
Business Environment went from 8 percent of the exam to 26 percent, and compliance is Task 2 inside it. The task did not move, but its weight roughly tripled. Anyone studying from pre-2026 material saw compliance as a corner of a minor domain and will meet it far more often than that preparation suggests.