Overview
IAM projects are magnets for Scope Creep. Because Identity connects to everything, everyone wants their problem solved now. "While you're connecting HR, can you also fix the payroll attributes?" "Since you're doing SSO, can you add these 50 legacy apps?" If you say yes to everything, the project never finishes. If you say no to everything, the business hates you. The consultant's art is managing the "Yes, but..." conversation—protecting the timeline while acknowledging the validity of the request.
Methodology & Frameworks
The "Iron Triangle"
Remind stakeholders of the project management triangle: Scope, Time, Cost.
- You can change one, but you must adjust the others.
- Consultant script: "I can absolutely add that application. It will require 3 extra days of engineering and will push the Go-Live date by one week. Does the Steering Committee approve that delay?"
MoSCoW Prioritization
Revisit the requirements using MoSCoW.
- Must Have: Critical for Day 1 (e.g., "Users can log in").
- Should Have: Important but can wait for Day 2 (e.g., "Self-service password reset").
- Could Have: Nice to have (e.g., "Custom logo on the login page").
- Won't Have: Explicitly out of scope for this phase.
Key Decisions
| Decision | Options | Recommendation | Notes / Gotchas |
|---|---|---|---|
| Handling New Requests | Ad-hoc vs. Change Control Board (CCB) | Change Control Board. | Never agree to scope changes in a hallway conversation. Force a formal request. |
| Pricing Changes | Free vs. Change Order (CR) | Change Order (even if $0). | Even if it costs $0, document the time cost. Paperwork reduces frivolous requests. |
| "Quick Wins" vs. Scope | Do it vs. Defer it | Do it (if truly < 2 hours). | Sometimes a small favor buys huge political capital. Just don't let it become a habit. |
| Customization | Config vs. Code | Config Only. | "We need the button to be blue." If the tool doesn't support it natively, say No. Custom code is technical debt. |
Implementation Approach
Phase 1: Baseline the Scope
Activity: Ensure the Statement of Work (SOW) or Project Charter lists exactly what is in scope and, more importantly, what is out of scope. Example: "Scope: 5 Applications (Salesforce, Slack, O365, Zoom, Box). All others are out of scope."
Phase 2: The Change Control Process
Activity: Define the process for adding scope.
- Requestor submits form.
- Technical Lead estimates impact (Time/Risk).
- Project Manager estimates cost.
- Steering Committee approves/rejects.
Phase 3: The "Phase 2" Bucket
Activity: Maintain a "Backlog" or "Phase 2" list. Tactic: When someone asks for something, say "That's a great candidate for Phase 2." Write it down visibly. It shows you are listening, even if you aren't doing it now.
Phase 4: Sprint Planning (Agile)
Activity: If using Agile, enforce sprint boundaries. Rule: Once a sprint starts, no new tickets enter. If a priority comes in, something else of equal size must come out.
Deliverables
- Change Request Form: Template for requesting new features.
- Change Log: Register of all approved and rejected changes.
- Updated Project Plan: Showing the impact of accepted changes.
- "Phase 2" Backlog: The list of deferred dreams.
Risks & Failure Modes
| Risk | Likelihood | Impact | Early Signals | Mitigation |
|---|---|---|---|---|
| Gold Plating | Med | Low | Engineers tweaking features to perfection instead of finishing. | "Good enough is good enough." Enforce "Done" criteria. |
| The "While You're At It" | High | Med | Stakeholders adding small tasks that add up to weeks. | Track every hour. Show the cumulative impact in the status report. |
| Sponsor Bypass | Low | High | Exec tells a developer directly to "just fix this." | Empower developers to say "Please ask the PM." Protect your team. |
| Feature Creep (Vendor) | Med | Med | Vendor releases a new feature mid-project; client wants it. | "That feature is in beta. Let's wait until it's stable (Phase 2)." |
KPIs / Outcomes
- Schedule Variance: Deviation from the original timeline.
- Budget Variance: Deviation from the original budget.
- Change Requests Approved: Number of formal changes processed.
- Backlog Growth: Number of items added to Phase 2 (indicates healthy demand).
Consultant's Notebook (Soft Skills)
The "Yes, and..." Improv Technique
- Bad: "No, we can't do that." ( shuts down conversation, creates conflict).
- Good: "Yes, we can do that, and it will require us to move the 'HR Integration' to next month. Which is higher priority for you?"
- This forces the client to make the trade-off, rather than you being the bad guy.
Beware of "Just"
- Whenever a client says "Can't you just...", your alarm bells should ring.
- "Just" implies they think it's easy. It rarely is.
- "Can't you just add a dropdown?" -> "That requires schema changes, API updates, and UI testing."
- Educate them on the complexity (gently).
Scope Creep vs. Discovery
- Sometimes, "Scope Creep" is actually "We missed a requirement."
- If the project cannot function without the new item (e.g., "We forgot that users need to log out"), that is not creep; that is a miss. Own it, fix it, and eat the cost if necessary. Integrity matters.