Your agile team is building a healthcare platform that must comply with HIPAA regulations. The compliance officer insists on reviewing and approving all designs before development begins and all code before deployment, which creates a bottleneck taking 5-7 days per review. The team's sprint cycle is two weeks, and this delay means most stories cannot be completed within a sprint. The compliance officer is unwilling to attend daily standups or sprint ceremonies, stating they are too busy. Team morale is declining as they cannot meet sprint goals. What is the MOST effective approach to resolve this situation?

Question

Accepted Answer

The correct answer is B. Option B is correct because it shifts left on compliance by embedding it into the team's practices rather than treating it as an external gate. By training the team on compliance requirements and creating clear Definition of Ready and Done criteria, the team can build compliance in from the start, reducing the need for extensive reviews. Automated compliance checks (similar to automated testing) can catch many issues immediately. This approach empowers the team, removes the bottleneck, and actually improves compliance by making it continuous rather than a checkpoint. It transforms the compliance officer's role from gatekeeper to enabler who sets standards the team can follow. Option A is incorrect because it accommodates the dysfunction rather than solving it. Extending sprints doesn't address the fundamental issue that compliance is being treated as a handoff rather than an integrated practice. Longer sprints reduce feedback frequency and agility without improving the underlying process. The goal should be to reduce the review cycle time, not extend the sprint to match it.

PMP Practice Question: Process — Agile, Hard

More Process Questions