ASPICE MAN.3 – Project Management: Simple BP-Wise Guide for Delivery Team Audits
ASPICE MAN.3 – Project Management: Simple BP-Wise Guide for Delivery Team Audits
ASPICE audits can sometimes feel complicated because of the terminology and process language. But MAN.3 – Project Management becomes much easier if we translate each Base Practice (BP) into three simple questions:
What should the team do? → What evidence should I see? → What should I ask?
This article provides a simple, practical guide that delivery managers, project managers, technical program managers, Agile coaches, and ASPICE auditors can use during an internal audit.
Note: Always align the BP numbering and wording with the specific Automotive SPICE version and process model used by your organization.
What is ASPICE MAN.3?
MAN.3 – Project Management focuses on planning, executing, monitoring, and controlling the project so that project objectives can be achieved.
In simple terms:
MAN.3 ensures that the project is properly planned, monitored, risks and issues are managed, dependencies are controlled, and corrective actions are taken when required.
ASPICE MAN.3 – BP-wise Simple Explanation
| BP | Simple Meaning | Expected Evidence | Simple Audit Question |
|---|---|---|---|
| BP1 | Define project scope | Project scope, boundaries, deliverables | “Show me the approved project scope. What is in and out of scope?” |
| BP2 | Define project activities and tasks | WBS, project plan, activities and tasks | “How did you break the project into activities and tasks?” |
| BP3 | Estimate effort and resources | Effort estimates, resource/capacity plan | “How did you estimate effort and team capacity?” |
| BP4 | Define project schedule | Schedule, milestones, release plan | “Show me the project schedule and key milestones.” |
| BP5 | Monitor project progress | Status reports, dashboards, KPI trends | “How do you know whether the project is on track?” |
| BP6 | Manage project risks | Risk register, mitigation plans | “Show me your top risks and mitigation actions.” |
| BP7 | Manage project issues | Issue tracker, escalation records | “Show me a major issue and how it was resolved.” |
| BP8 | Manage changes | Change requests, impact analysis, approvals | “Show me a recent change and its impact.” |
| BP9 | Ensure communication | Status reports, meeting minutes, communication records | “How do you ensure stakeholders receive project status?” |
| BP10 | Manage stakeholders | Stakeholder list, RACI, communication plan | “Who are your key stakeholders?” |
| BP11 | Manage interfaces and dependencies | Dependency tracker, interface records | “Show me your critical dependencies and how they are tracked.” |
| BP12 | Manage project quality | Quality plan, reviews, quality metrics | “How do you know project quality expectations are being met?” |
| BP13 | Conduct project reviews | Steering reviews, milestone reviews, action items | “Show me evidence of project reviews and decisions.” |
How Should You Audit MAN.3?
A good audit should go beyond checking whether a document exists.
I recommend using the 4E approach:
1. Expectation
Understand what the team is expected to do.
Example:
Does the project have a defined approach for identifying and managing risks?
2. Evidence
Ask the team to show the actual evidence.
For risk management, this could include:
Risk register
Risk owner
Probability and impact
Mitigation action
Target date
Current status
3. Execution
Don't stop at the document.
Pick one real example and ask:
“Walk me through this risk from identification to closure.”
This helps you verify whether the process is actually being followed.
4. Effectiveness
Finally, ask:
“What happened after the mitigation? Did the risk exposure actually reduce?”
This is where you move from process compliance to process effectiveness.
Example: Auditing Risk Management
Let's take BP6 – Risk Management as an example.
Auditor Question 1
“Show me your current project risk register.”
Check whether risks have:
Description
Owner
Probability
Impact
Priority
Mitigation
Due date
Status
Auditor Question 2
“Show me your top three risks.”
Don't accept only the risk names.
Ask:
“Why is this a top risk?”
Auditor Question 3
“Who owns this risk?”
There should be a clear owner.
Auditor Question 4
“What mitigation action has been taken?”
Look for actual actions rather than statements such as:
“Team is monitoring.”
Auditor Question 5
“How do you know the mitigation was effective?”
This helps demonstrate that risk management is actively performed.
Most Important MAN.3 Evidence
For a delivery team, I would expect to see a connected chain of evidence:
Project Scope
↓
WBS / Activities
↓
Effort & Resource Plan
↓
Schedule & Milestones
↓
Risks & Dependencies
↓
Execution Tracking
↓
Status & KPI Monitoring
↓
Issues & Changes
↓
Project Reviews
↓
Corrective Actions
The important thing is not just having these documents.
The auditor should be able to trace the project story from planning to execution and corrective action.
10 Powerful MAN.3 Audit Questions
If you have limited time during an internal audit, these questions can give you a very good picture of project management maturity.
1. What exactly is your project scope?
2. What are your major deliverables and milestones?
3. How did you estimate effort and resources?
4. What is your current schedule status versus the baseline?
5. What are your top three project risks?
6. What are your critical cross-team dependencies?
7. Show me one major issue and explain how it was resolved.
8. Show me one recent change and its impact analysis.
9. What project metrics are you monitoring?
10. Show me a project review where management took a decision based on project data.
How to Write a Good ASPICE Audit Finding
Avoid vague findings such as:
❌ “Risk management is not good.”
Instead, make your finding specific and evidence-based.
Weak Finding
Risk management is not effective.
Better Finding
The project maintains a risk register; however, three high-priority risks do not have documented mitigation owners or target completion dates. Therefore, active risk treatment cannot be demonstrated.
This type of finding is:
Specific
Evidence-based
Traceable
Easier to understand
Easier to correct
A Simple Rule for Delivery Teams
One rule I recommend every Project Manager, Engineering Manager, and Technical Program Manager remember is:
“Don't tell me that you manage the project. Show me the evidence that proves you manage it.”
For MAN.3, strong evidence is not just a document.
It is the connection between:
Plan → Execute → Monitor → Identify Deviation → Take Action → Verify Outcome
That is what makes project management demonstrable during an ASPICE audit.
Final Takeaway
ASPICE MAN.3 is essentially about controlled project execution.
A mature project should be able to answer five simple questions:
Where are we going?
→ Scope & objectives
How will we get there?
→ Activities, resources & schedule
What could go wrong?
→ Risks, issues & dependencies
How do we know we are on track?
→ Metrics & monitoring
What do we do when things change?
→ Corrective actions & change management
If your delivery team can demonstrate these five areas with objective evidence, you are in a much stronger position for an ASPICE MAN.3 assessment.
#ASPICE #AutomotiveSPICE #MAN3 #ProjectManagement #SoftwareEngineering #AutomotiveSoftware #Agile #TechnicalProgramManagement #TPM #ProcessImprovement
Comments
Post a Comment