“Project Management for Compliance and Audit: A Practical Guide”

Why is compliance project management different from delivery project management?

project management for compliance and audit is a key topic in modern project management and teamwork. Because you do not control the deadline and you cannot negotiate the acceptance criteria. A product team can move a launch date. A compliance team facing a statutory reporting deadline cannot. The auditor also defines what counts as sufficient evidence, which means “done” is decided by an external party reading a sample months later.

The implication is that compliance planning is capacity planning against immovable dates. You work backwards from the audit window, subtract review and remediation time, and discover how many control tests per week the team must complete. If that number exceeds capacity, you either reduce scope through rationalisation or add people. Wishing does not create hours.

What does a compliance programme plan contain?

A workable plan has five layers, and each one produces an artefact you can audit. Skipping a layer is what produces the classic situation where the policy exists, the control is described, and nobody can prove it operated in March.

1. Obligation register. Every requirement that applies to you, with its source, the clause, the interpretation, the accountable executive, and the review date. For a mid-sized company this is often 200 to 600 lines across privacy, security, financial reporting, employment, and sector rules.
2. Control map. Each obligation mapped to one or more controls, with the control owner, frequency, evidence produced, and system of record. Many-to-many mapping is normal; pretending it is one-to-one is how gaps hide.
3. Evidence plan. For every control, what artefact proves it operated, where it is stored, who uploads it, and how long it is retained. This is the layer most programmes underinvest in.
4. Testing calendar. When each control is tested, by whom, using what sample size, and with what pass criteria. Internal testing should finish before the external auditor’s fieldwork, not during it.
5. Remediation backlog. Findings with severity, root cause, owner, due date, and verification method. A finding without a due date is a note, not a commitment.

How do you plan around fixed regulatory deadlines?

You build a deadline register and treat every entry as a mini-project with dependencies. The dates below are the ones that shaped compliance programmes in the mid-2020s and are worth checking against your own scope.

Two planning rules follow. First, regulatory dates cascade: a single EU regulation can require vendor contract changes, which require legal review, which requires a negotiation queue, so the visible deadline hides a nine-month dependency chain. Second, the scoping decision is the highest-leverage project in the plan. Cutting ten systems out of scope often removes more work than a year of process efficiency.

How do you build an evidence trail that survives an auditor?

Design evidence at the same time as the control, and make it a by-product of normal work. If evidence has to be assembled specially for the audit, it will be incomplete, late, and contested.

Three details decide whether the trail holds. The evidence must be dated by the system that produced it, not by the person who exported it. The sample must be traceable to the population, meaning you can show the full list the sample was drawn from. And the reviewer must be identifiable, which rules out generic shared mailboxes as approvers.

Worked example: can the team actually test 240 controls?

Suppose the programme covers 240 key controls across finance, IT, and operations, and the external auditor expects four samples per control for the annual cycle. That is 960 sample items. At 20 minutes to locate and package each item, plus 10 minutes of reviewer check, the sampling work alone is 480 hours. Add a 45-minute walkthrough per control, 180 hours, and the total is 660 hours.

Spread over a ten-week testing window, that is 66 hours per week, or about 1.65 full-time equivalents doing nothing else. If the team has one person at 60% availability, the plan is short by roughly 400 hours, and the shortfall will be absorbed by overtime in the two weeks before fieldwork — exactly when quality drops and findings rise.

The arithmetic changes the conversation. Instead of asking for “more compliance support,” you can show that 240 controls at four samples is 960 items, that the current capacity covers 560, and that the options are rationalise to 150 controls, reduce samples to two for low-risk controls, or add 0.7 FTE for ten weeks. That is a decision a CFO can make.

How do you run remediation as a project?

Remediation is a backlog with severity, not a list of intentions. Every finding needs a root cause that is more specific than “human error,” an owner at the level that can change the process, and a verification step that is separate from the fix itself.

Track two metrics, not one: the percentage of findings closed on time, and the percentage of findings that recur in the next cycle. The second number is the honest one. A team closing 95% of findings on time while the same five issues reappear every year is not remediating; it is re-labelling.

What does compliance actually cost, and how should you budget it?

Budget by obligation and by evidence, not by a single lump sum. The GAO’s 2025 report on Sarbanes-Oxley compliance, based on 1,454 survey respondents, estimated average annual Section 404 costs of $676,000 in audit fees, $434,000 in internal labour, $208,000 in outside consultants, and $83,000 in other expenses, for a total near $1.4 million.

That breakdown is useful because the levers are different for each line. Audit fees fall with better evidence quality and reduced scope. Internal labour falls with automation of sampling and access reviews. Consultant spend falls when the programme has a repeatable methodology rather than an annual rebuild. Other expenses, which include tools and training, are usually the smallest line and the easiest to cut — which is why they are cut first and hurt most later.

For a smaller private company the absolute numbers are lower, but the ratio usually holds: external fees are the largest single line, and they respond more to evidence quality than to negotiation.

What are the trade-offs between continuous compliance and an annual sprint?

An annual sprint concentrates cost and risk into a few months. Continuous compliance spreads the work and requires discipline every month. Most organisations end up with a hybrid: continuous evidence capture, periodic testing, annual attestation.

The honest trade-off is attention, not money. Continuous compliance costs roughly the same in total hours but demands that control owners do small tasks every month instead of large tasks once a year. Teams that cannot sustain monthly discipline should choose the sprint model deliberately and staff the peak, rather than pretending to be continuous and failing quietly.

How do you run one control programme across multiple frameworks?

Most companies do not have one compliance obligation; they have five. Financial reporting, information security, payment data, privacy, and a sector rule each describe similar controls in slightly different language, and each auditor asks for evidence in a different format. Run them as five separate programmes and you will test the same access review five times.

The fix is a single control library with many-to-many mapping. One access-review control can satisfy a financial reporting requirement, an ISO 27001 annex control, and a payment standard clause at the same time, provided the evidence pack records which obligation it supports. The library becomes the unit of work; the frameworks become views of it.

Three practical rules keep the model honest:

• Map to the strictest requirement, then evidence once. If one framework demands quarterly reviews and another demands annual, run quarterly and record both mappings.
• Keep framework-specific artefacts thin. A short crosswalk document per framework is enough; do not rebuild the control description five times.
• Assign one owner per control, not one owner per framework. Framework owners coordinate, control owners operate.

The saving is real. A company testing 240 controls across three frameworks separately might run 500 test events a year. Mapped properly, the same coverage can often be achieved with 280 to 320 events, which is the difference between a sustainable cycle and a permanent backlog. When a new regulation arrives, you add obligations and mappings, not a parallel programme.

What mistakes cause repeat audit findings?

The most common is a control with no named owner. “The finance team” cannot be accountable; a person can. The second is evidence stored in personal drives and email threads, which is invisible to a sample and lost when someone leaves.

The third is remediation without root cause. Changing a screenshot format does not fix a control that never runs. The fourth is scope drift in the other direction: teams add frameworks without retiring controls, so the control count grows every year while the team stays the same size. Rationalisation is a compliance activity, not an admission of weakness.

The fifth is treating the auditor as an adversary. Auditors test what you show them. A pre-read pack with the control description, population, sample, and evidence index turns a three-week fieldwork into a one-week review, and it costs a day to prepare.

How does Doitify fit into a compliance programme?

Doitify is useful for the parts that behave like projects: remediation backlogs, evidence collection tasks, audit preparation checklists, and the recurring calendar of control testing. Each finding becomes a task with an owner, a due date, and a linked evidence item, and the monthly compliance report is generated from the same workspace rather than rebuilt in a spreadsheet.

Transparency note: Doitify is our product. It is a project and goal management platform, not a GRC system, and it does not replace control automation or a document management system with retention rules. Use it for coordination and accountability, and keep the system of record where the evidence actually lives.

Conclusion

Compliance programmes do not fail because the rules are unclear. They fail because obligations were never converted into owned controls, and controls were never converted into retrievable evidence. Build the obligation register, map the controls, design the evidence at the same time, and run remediation as a backlog with dates. Then the audit becomes a review of work you already did, which is the only version of audit season worth planning for.

If this post on project management for compliance and audit was helpful, you might also enjoy How to Create a Resource Plan: A Step-by-Step Guide for Project Managers and Milestone vs Deliverable: What’s the Real Difference?.