PMP · Question #1272
A company has an existing contract to maintain and enhance a client's customer database. The company's legal department informs the project manager that a new piece of legislature requiring stricter…
The correct answer is A. Update the risk register to include this issue and discuss the appropriate risk response plans with. A project manager must proactively manage the risk of potential new legal requirements affecting project scope.
Question
Options
- AUpdate the risk register to include this issue and discuss the appropriate risk response plans with
- BAsk the legal department to raise the issue in the next contract negotiation with the customer.
- CSeek the project sponsor's support to influence the client to amend the contract immediately.
- DWait until the legal requirements are finalized so the change in scope can be concretely defined.
How the community answered
(35 responses)- A74% (26)
- B14% (5)
- C3% (1)
- D9% (3)
Why each option
A project manager must proactively manage the risk of potential new legal requirements affecting project scope.
The potential new legislation and its impact on required security features constitute a significant project risk, even if not yet finalized. The project manager's first action should be to formally document this in the risk register and immediately begin discussing potential risk response strategies with relevant stakeholders, such as contingency plans or proactive engagement with the client regarding scope changes.
Waiting for the *next* contract negotiation is a reactive approach that could leave the project unprepared and in non-compliance if the law passes sooner or requires immediate action.
Seeking the sponsor's support to influence a client to amend a contract immediately is premature; the first step is to assess the risk thoroughly, understand its impact, and define potential solutions before escalating to a contract amendment discussion.
Waiting until the legal requirements are finalized is a reactive approach that delays risk planning and may leave insufficient time to implement necessary changes, potentially leading to non-compliance or project failure.
Concept tested: Proactive risk management
Topics
Community Discussion
5
Prof. SaraMay 31, 2026A. This is a future regulatory change, so it is a risk, not a definite change request yet. Update the risk register and discuss appropriate risk response plans, since analyzing and documenting potential impacts before the law is finalized is the proactive PMP approach. Option D is too passive for a certified project manager, and B and C jump to contract actions before the risk has even been assessed.
Anjali D.Jun 2, 2026Agreed on A, and worth adding that the risk response plan might include a reserve allocation recommendation, since that ties the risk register entry directly to budget conversations stakeholders will inevitably want to have.
Brenda K.May 26, 2026First leaned toward D because waiting for finalized requirements sounded like avoiding premature changes, but the second I saw option A mention updating the risk register, the clock should have stopped there. This is a textbook risk identification scenario, not a change control scenario yet, and on exam day that distinction is a 20-second quick win if you catch the keyword "might soon be" in the stem.
Prof. SaraMay 27, 2026Spot on Brenda, and that "might soon be" phrasing maps directly to Domain 1 risk identification, though I would add one nuance: the risk register update should capture the potential change as a trigger condition, not just a standalone risk, since finalized requirements would convert it into an actual change request under Domain 4.
Anjali D.Jun 7, 2026Got this exact scenario on my exam last month, and A is the move because a potential law change is a classic risk that belongs in the risk register before you do anything else. Our study group was split between A and D since waiting feels practical, but the PMI mindset is to document and assess risk responses proactively rather than sitting idle.