Processes are the building blocks of every organization. Yet, many organizations do not have consistent and repeatable processes. Research shows that projects managed using structured processes leveraging “best practices” consistently show higher performance than those that do not. This session focuses on a method from ISO to improve processes and eliminate defects. Assessing process capability demonstrably helps lower risk associated with the processes. Main points covered: • What is a Process Reference Model? • What is process capability and how do I measure it? • How to use a Process Assessment Model to assess processes? Presenter: Peter Davis is the Principal of Peter Davis Associates, a management consulting firm specializing in Governance, Security, and Audit. Prior to founding PDA, Mr. Davis’ private sector experience included stints with two large Canadian banks and a manufacturing company. He was formerly a principal in the Information Systems Audit practice of Ernst & Young. In the public sector, Mr. Davis was Director of Information Systems Audit in the Office of the Provincial Auditor (Ontario), where he had oversight audit responsibilities for all Ontario crown corporations, agencies and boards. Mr. Davis has written or co-written 13 books including “Project Management Process Capability Assessment,” “Lean Six Sigma Secrets for the CIO,” and “Hacking Wireless Networks for Dummies.” Peter currently teaches COBIT 5 Foundation/Implementation/Assessor/Implementing NIST Cyber-security Framework using COBIT 5, ISO 20000 FC/LI/LA ISO 27001 LI/LA, ISO 27032 LM, ISO 27005 RM, and ISO 31000 RM. Organizer: Ardian Berisha Date: September 5th, 2018 Recorded webinar link: https://youtu.be/NECQ5Angadw

2. Agenda
Process review
Process assessment model
Process reference model

3. Process
 A process is a logically related
series of activities intended to
contribute towards reaching a
defined objective
 Process Owner responsible for
process results
 Process Manager responsible
for realization and structure of
the process and reports to PO
 Process Operatives
responsible for defined
activities and reports to PM
 Standards = KPI
 Processes described using
procedures and work
instructions

4. Processes
Everything we do can be considered a
process or part of a process
Every process can be characterized by:
Average performance
Variation
Processes are performing optimally when
the result of the process is at the expected
value (meaning there is minimal variation)

5. Problems with Processes
 Customers complain that the process:
 Costs too much (they are not willing to pay for it)
 Takes too long
 Delivers a “Cadillac” solution or product when the customer wanted
something simpler, faster and cheaper
 Processes can contain “hidden factories” or costly sub-
processes put in long ago to fix a problem
 Processes contain waste in the eyes of the customer and need
to be leaned out
 Waste is something the customer is not willing to pay for
during a process

6. Process Capability
 Process limits (The “Voice of the Process” or The “Voice of
the Data”) - based on natural (common cause) variation
 Tolerance limits (The “Voice of the Customer”) – customer
requirements
 Process Capability – A measure of how “capable” the
process is to meet customer requirements; compares
process limits to tolerance limits

7. ISO/IEC 15504 a.k.a. SPICE1
1Software Process Improvement and Capability dEtermination
Process
Process
Assessment
Capability
Determination
Process
Improvement
Identifies capability and
risks of
Identifies changes to
Leads to
Is
examined
by
Leads to

8. What is a Process
Assessment Model?
Process Reference Model
 Domains and Scope
 Processes with Purposes and
Outcomes
CapabilityScale
Process entities
Measurement Framework
 Capability Levels
 Process Attributes
 Rating Scale
Process Assessment Model

9. INITIAL INPUT
• Purpose
• Scope
• Constraints
• Identities
• Approach
• Assessor
Competence Criteria
• Additional Information
Process Reference Model
• Domain and Scope
• Process Purpose
• Process Outcomes
Process
Assessment Model
• Scope
• Indicators
• Mapping
• Translation
Measurement Framework
• Capability Levels
• Process Attributes
• Rating Scale
OUTPUT
• Date
• Assessment Input
• Identification of
Evidence
• Assessment
Process Used
• Process Profiles
• Additional Information
Roles and Responsibilities
• Sponsor
• Competent Assessor
• Assessors
ASSESSMENT PROCESS
• Planning
• Data Collection
• Data Validation
• Process Attribute Rating
• Reporting
P
A
M
A
s
s
e
s
s
m
e
n
t
P
r
o
c
e
s
s

10. Sample Process Assessment Model

11. The PM Process Assessment Model
Process
Reference Model
(PRM)
Measurement
Framework
Assessment
Process

12. Process Reference Models
 COBIT 5: Process Assessment Model (PAM): Using COBIT 5
 ISO 21500: Project Management Capability Assessment
 ISO/IEC 33071: Process assessment — An integrated
process capability assessment model for Enterprise
processes
 ISO/IEC TS 33072: A process assessment model for
information security
 ISO 33081: An Integrated Organizational Maturity Model
for Software and Systems Engineering
 TIPA: Tudor ITSM Process Assessment

13. Process Reference Models
 COBIT 5: Process Assessment Model (PAM): Using COBIT 5
 ISO 21500: Project Management Capability Assessment
 ISO/IEC 33071: Process assessment — An integrated
process capability assessment model for Enterprise
processes
 ISO/IEC TS 33072: A process assessment model for
information security
 ISO 33081: An Integrated Organizational Maturity Model
for Software and Systems Engineering
 TIPA: Tudor ITSM Process Assessment

14. ISO 21500 PRM

15. Governance Process
Area Governance
Domain Establish
Process ID ES01
Process Name Define and manage the project management framework
Process Description Clarify and maintain the governance framework for project management. Implement and maintain
tools and techniques and authorities to manage projects in line with enterprise objectives.
Process Purpose
Statement
The purpose of Define the project management framework is to provide a consistent project
management approach to enable enterprise governance requirements to be met, covering project
management processes, organizational structures, roles and responsibilities, reliable and
repeatable activities, and skills and competencies.
Outcomes
Number Description
ES01-01 A project management framework is defined.
ES01-02 A project management framework is followed.

16. Governance Process
Base Practices (BPs)
Number Description Supports
ES01-BP1 Define a project management
framework for IT investments.
ES01-01
ES01-BP2 Establish and maintain an IT project
management framework
ES01-01
ES01-02
ES01-BP3 Establish Project Management Office ES01-01

17. Governance Process
Work Products
Inputs
Number Description Supports
From corporate governance Decision-making model ES01-01
ES01-02
ES03-WP1 Authority limits ES01-01
ES01-02
From corporate governance Enterprise governance guiding principles ES01-01
ES01-02
From corporate governance Process architecture model ES01-01

18. Governance Process
Outputs
Number Description Input to Supports
ES01-WP1 Project management guidelines All processes ES01-01
ES01-WP2 PMO Charter All processes ES01-01
ES01-WP3 Definition of organizational structure
and functions
All processes ES01-01
ES01-WP4 Definition of project-related roles and
responsibilities
All processes ES01-01
ES01-WP5 Process capability assessments All processes ES01-02
ES01-WP6 Performance goals and metrics of
process improvement tracking
All processes ES01-02

19. Governance Process
References
Document Section
COBIT 5 Framework APO01
ISO 21500:2012 3.4.2, 3.6
PMBOK 6th Edition 1.4
PRINCE2 6

20. …
Level
5
Level
4Level
3
Level 2
Level
1Level
0
Capability
Dimension
Innovating process (2 attributes)
Incomplete process
Performed process (1 attribute)
Managed process (2 attributes)
Established process (2 attributes)
Predictable process (2 attributes)
Based on ISO /IEC 33020
Process Assessment Model (PAM) Overview
Establish (ES) 3
Monitor (MO) 3
Initiate (IN) 3
Plan (PL) 16
Implement (IM) 7
Control (CO) 11
Close (CL) 2
45

21. …
Level
5
Level
4Level
3
Level 2
Level
1Level
0
Capability
Dimension
Establish (ES) 3
Monitor (MO) 3
Initiate (IN) 3
Plan (PL) 16
Implement (IM) 7
Control (CO) 11
Close (CL) 2
45
Process Assessment Model (PAM) Overview
Based on (Level 1 to 5)
Process Attribute
Indicators (PAI):
- GP : Generic Practice
- GWP: Generic Work
Product
Additional performance
indicators Level 1 based
on:
- BP : Base practices
- WP : Work products
PA5.2 Process innovation implementation
PA5.1 Process innovation
PA3.1 Process definition
PA2.1 Performance management
PA1.1 Process performance
PA4.1 Quantitative analysis
PA4.2 Quantitative process control
PA2.2 Work product management
PA3.2 Process deployment

22. ISO 33004
a. Appropriate data are
collected and analyzed as
a basis for understanding
the behaviour of the
process, to demonstrate
the suitability and
effectiveness of the
process, and to evaluate
where continual
improvement of the
process can be made.
GP3.2.6 Collect and analyze
data about performance of
the process to demonstrate
its suitability and
effectiveness. Data required
to monitor the suitability and
effectiveness of the process
across the organization are
defined, collected and
analyzed as a basis for
continual improvement.
GWP4.0 Quality records.
Should provide evidence of
reviews undertaken for each
instance of the process.
GWP9.0 Process performance
records. Should provide
evidence of reviews
undertaken for each instance
of the process.
PA 3.2 Process Deployment: This process attribute is a measure of the extent to which the
standard process is deployed as a defined process to achieve its process outcomes.

23. ISO 33004
© 2017 Peter Davis+Associates 23
b. Assignable causes of process
variation are determined through
analysis of the collected data.
GP4.2.2 Analyze measurement data of
the process to identify real and
potential variations in process
performance. Process performance
data are analyzed to identify variations
in process performance together with
the root cause of common process
performance issues.
GP4.2.3 Analyze process and product
measurement results to identify
variations in process performance. The
results of process control
measurements are analyzed to
GWP9.0 Process performance records.
Should provide details of
measurements collected and analyzed.
PA 4.2 Quantitative Process Control: This process attribute is a measure of the extent to
which objective data is used to manage process performance that is predictable.

24. ISO 33004
a. Corrective actions are
taken to address
special causes of
variation.
GP4.2.5 Identify and
implement corrective
actions to address
assignable causes.
Corrective action is taken
to address process
control concerns and
results are monitored and
evaluated.
GWP9.0 Process
performance records.
Should provide details of
measurements collected
and analyzed and
corrective action taken.
PA 4.2 Quantitative Process Control: This process attribute is a measure of the extent to
which objective data is used to manage process performance that is predictable.

25. Rating Scales
Rating Meaning Level of Achievement
P - Partially achieved - > 15 % to ≤ 32.5 %
P + Partially achieved + > 32.5 % to ≤ 50 %
L - Largely achieved - > 50 % to ≤ 67.5 %
L + Largely achieved + > 67.5 % to ≤ 85 %
Rating Meaning Level of Achievement
N Not achieved 0 % to ≤ 15 %
P Partially achieved > 15 % to ≤ 50 %
L Largely achieved > 50 % to ≤ 85 %
F Fully achieved > 85 % to ≤ 100 %

26. Assessment Process
Sponsor
Co-
ordinator
Assessors
Process Owner/s?
Process
Professional/s?
Lead
Assessor
Other Participants

27. Consequence of Capability Gaps
Capability level where
gap occurs
Nature of consequence Seriousness of
consequence
5 – Innovating process
Inability to achieve or evaluate process
requirements
Lowest
Highest
4 – Predictable process
Inability to quantify performance or
detect problems early
3 – Established process
Inconsistent process performance
across organization
2 – Managed process
Cost or time overruns; unpredictable
product quality
1 – Performed process
Missing work products; process
outcomes not achieved

28. Potential consequences of process attribute gaps
Gap/s in Process
attribute
Potential Consequences
 missing work products; process outcomes not achieved
 cost or time overruns; inefficient use of resources
 unclear responsibilities, uncontrolled decisions, and uncertainty
over whether time and cost objectives will be met
 unpredictable product quality and integrity, uncontrolled versions,
 increased support costs, integration problems and increased
rework costs identified best practice and lessons learned from previous projects
not defined, published and available within organization
 no foundation for organization-wide process improvement
 no quantitative understanding of how well process performance
objectives and defined business goals are being achieved
 no quantitative ability to detect performance problems early
 implemented process not incorporating identified best practice
and lessons learned from previous projects; inconsistent process
performance across organization
 lost opportunities to understand process and identify
improvements.
 process not capable and/or stable (predictable) within defined
limits
 quantitative performance objectives and defined business goals
not met
 inability to change process effectively to achieve relevant process
improvement objectives
 inability to evaluate effectiveness of process changes
 process improvement objectives not clearly defined
 opportunities for improvement not clearly identified
PA 1.1 Process
performance
PA 2.1 Performance
management
PA 2.2 Work product
management
PA 3.1 Process definition
PA 3.2 Process
deployment
PA 4.1 Quantitative
analysis
PA 4.2 Quantitative
process
controlPA 5.1 Process
innovation
PA 5.2 Process
innovation
implementation
Source: This figure is reproduced from ISO/IEC 15504-4. Copyright
remains with ISO/IEC.

29. Capability Gaps and Risk
Consequence indicated
by capability level
where gap occurs
Probability indicated by extent of capability level gap
Slight Significant Substantial
5 – Innovating process Low risk Low risk Low risk
4 – Predictable process Low risk Low risk Medium risk
3 – Established process Low risk Medium risk Medium risk
2 – Managed process Medium risk Medium risk High risk
1 – Performed process Medium risk High risk High risk

30. Review
Process review
Process assessment model
Process reference model

31. PECB
Training Courses
• Information Security
• Quality Management Systems
• Continuity, Resilience And Recovery
• IT Security
• Governance, Risk And Compliance
Exam and certification fees are included in the training price.
https://pecb.com/en/education-and-certification-for-individuals
www.pecb.com/events

32. THANK YOU
?
ptdavis@pdaconsulting.com
www.pdaconsulting.com
www.linkedin.com/in/pdaconsulting/
www.processcapabilityassessment.com