IBM Innovate2014 - Is Agile Compliance an Oxymoron?

agile42 | We advise, train and coach companies building software www.agile42.com | All rights reserved. Copyright ©2007-2014.
Is agile compliance an oxymoron?
@davesharrock

compliance international B2B MBA English IPO
agile husbandstart-up technology
newly-minted Canadian IT
executive leanstartup outsourcing father
enterprise transitions
B2C data analysis kanban seismology PhD
scrum geophysicist
organizational excellence
Certiﬁed Scrum Trainer® (CST)
Certiﬁed Scrum Coach (CSC)
dave.sharrock@agile42.com
twitter: @davesharrock
www.facebook.com/agile42
Dr Dave Sharrock

Why Agile?

Growing Software
Complexity
Software complexity in FORD
vehicles quadruplicated in 5
years
0
2.5
5
7.5
10
2005 2006 2007 2008 2009 2010
10
6
4.5
3.4
2.8
2.4
Software lines in FORD vehicles over 5 years
x4
MLOC in Ford vehicles

Increasing Complexity in
Technology Environments
Language types and versions released per
decade, taken from O’Reilly’s Programming
Language Timeline
0
22
44
66
88
110
1954-1959 1960-1964 1965-1974 1975-1984 1985-1994 1995-2004
104
50
41
25
1211
New programming languages and versions released
x10

Time to Market
Due to globalization eﬀects, and
other economical changes, the
time to market over time
decreased signiﬁcantly
Deepa Chandrasekaran, Gerard J. Tellis - Marshall School of Business, University of Southern California, Los Angeles, California
1915 1939 1972 1976 1983 1994 1998 2000 2002 2004
13.5 years
3
m
onths
Mean time to take-off

Agile projects are 3x more successful than non-
agile projects*
The report goes so far as to say,
“The agile process is the universal
remedy for software development
project failure. Software applications
developed through the agile process
have three times the success rate of
the traditional waterfall method and
a much lower percentage of time
and cost overruns.” (page 25)
* According to the 2011 CHAOS report from the Standish Group
The Standish Group deﬁnes
project success as:
• on time
• on budget
• with all planned features

Why does that matter?

Deﬁned Process Control
The time required to complete a
repeatable action is a valid proxy to
predict time to complete

Empirical Process Control
Every step performed while
creating a new product is unique,
only outcome can be trusted

And compliance?

Why should it be more difﬁcult to apply Agile where IT
governance & regulatory compliance is enforced?

We only listen to the cool
kids at school
https://www.ﬂickr.com/photos/jordyn-tacozombie/5555279358/

Our intuitive response is
to increase control
kids at school
https://www.ﬂickr.com/photos/cmdrcord/

Our intuitive response is
to increase control
kids at school
Compliance too often bad
cop, not good referee
https://www.ﬂickr.com/photos/clydeorama/

what is governance and
regulatory compliance?

Goals of IT Governance
& Regulatory Compliance
The primary goals for information
technology governance are to:
1. Assure that investment in IT
generates business value, and
2. Mitigate the risks associated
with IT
Primary goals of regulatory
compliance
1. Meet federal or industry
minimum standards
2. Typically breakdown into:
• Work Authorization
• Segregation of Duties
• Process Change Control
• Audit Support

Comparing the goals
1
2
3
4
Quality
Productivity
Predictability
Business Value
Business Value
Risk Management
Effectiveness
Exceed requirements
governance agility

Interpreted to be prescriptive
"The system by which the
current and future use of
ICT is directed and
controlled. It involves
evaluating and directing
the plans for the use of
ICT to support the
organisation and
monitoring this use to
achieve plans. It includes
the strategy and policies
for using ICT within an
organisation."
Australian Standard
"… the leadership and
organisational
structures and
processes that ensure
that the organisation’s
IT sustains and extends
the organisation’s
strategies and
objectives"
IT Governance Institute
“The structure,
oversight and
management processes
which ensure the
delivery of the expected
beneﬁts of IT in a
controlled way to help
enhance the long term
sustainable success of
the enterprise.”
ISACA

Achieving agility vs. compliance
Communica)on
Empowerment
Transparency
Adaptability
Itera)ve
&
Incremental
Deﬁned
Process
&
Standards
Plan
›
Analyze
› Develop
› Test
Traceability
Formal
review
and
approval
Conﬁgura)on
Management
governance agility

how to reconcile agile and
governance processes

Agile delivery

The wrong way to deliver agile compliance
0
1
2
3

Scrum process
1.
Interac)on
2.
Documenta)on
3.
Automa)on

Interaction

CONCEIVE DESIGN IMPLEMENT DEPLOY
A typical product development process
time-to-market

value
adding
non-value
adding
Mapping the value stream
time-to-market

value
adding
non-value
adding
Common non-value adding steps include...
time-to-market

Merging agile and compliance needs
Interac(on
• Role
of
involved
stakeholder
• Deﬁnes
minimum

requirements
to
be
met
• Reviews
Requirements
&

User
Stories
• Provides
reviews/direc)on

within
Sprint

Documentation

Is documentation
waste?
“Everything that does
not add value to the
product is waste”
1st
principle
of
lean

development

Is documentation waste?
“If you must produce paperwork that adds little customer
value, there are three rules to remember: Keep it short. Keep
it high level. Do it ofﬂine.”
“Safety-critical systems are frequently regulated and are
often required to have written requirements, traceable to
code. In this case, formatting the requirements so that they
can easily be evaluated and checked for completeness may
qualify as a value-adding activity. Look for a table driven or
template driven format that reduces the requirements to a
condensed format that both users and development can
rapidly understand and validate.”
Mary Poppendieck, Lean Software Development

Changing role of specifications
Requirements
Specifica(ons
Design
Code
Tests
Requirements
Specifica)ons

drive
implementa)on
Requirements
document
system
as-‐built
Requirements
Specifica(ons
Epics
User
Stories
Acceptance
Criteria
Design
Code
Validate
/
Update
Define
/
Execute
Tests
governance agility

Changing role of standard operating procedures
Standards
reduce

varia)on
and
allow

untrained
people
to

make
decisions.
WriPen
standards
are

to
be
followed,
not

changed.
A
Standard
deﬁnes

goals
for
a
team
to

reach,
and
constraints

to
observe.

An
Agile
Team
will
use

it
as
a
baseline
for

con)nuous
process

improvement.
governance agility

Changing role of document review and approval
This
document
is
now

approved
as
input
for
the

next
development
phase.

This
document
is
now

part
of
a
consistent

product
increment.
The
Deﬁni)on
of
Done

and
Deﬁni)on
of
Ready

allow
seSng
of
minimal

requirements
to
pass
to

the
next
phase.
governance agility

Lean Canvases... What?

Lean Portfolio Canvas™ have been created by agile42 and are licensed using Creative Common 3.0 with attribution (by), non commercial usage (nc) and share alike (sa) options. You can reuse and modify
the template, but you will always have to leave the logo on it
Feature Name (title)
1. Opportunity 2. Customer Segments
What is the problem to be solved? What type of customers & users will
benefit from this solution?
How is the customer solving the
problem right now?
3. Possible Solution
What are the key points of a possible
solution to the presented problem?
4. Benefits
What are the benefits for the
customers?
What are the benefits for internal
stakeholders?
6. Measuring Success
What metrics will be best measure the
success of the feature?
5. Business Readiness
What steps are required from the
business side to be able to use this
capability?
7. Cost of Delay
Which profile better represent the cost
of delay (CoD)?
8. Costs Structure
How does the cost structure look like for such a feature? One time, ongoing
costs, contractors expenses, development costs?
9. Value to Customer and Business
What are the expected incremental revenue for selling this feature, and what are
the strategic and tactical benefit? What are the intangible values (usability,
performance, customer knowledge obtained...)
It will contain 5000 songs
Current digital
music player can
only hold up to
20 songs
Re-sync their
music frequently
- Jogging lovers
- Bicycle riders
- Music
Professionals
- media store
1000+ songs
- fit in a pocket
- compression
- no need to sync
often
- change mood
change song
- playlists
- addressing a
new market
- micro
engineering
- partnership with
component
builder
- sales channels
- Packaging
- Agreement with
Music Firms?
- Hardware development cost
- SKU costs target $170.00
- 3rd parties licenses for digital
music
- Usability with one hand
- Long battery life
- All songs you own in one place
- store 1000 songs
(HQ)
- 1000 early
adopters/week on
1st month
How Can
we test
this?

Minimal Viable Product
Experiment
with Target
Consolidate
learnings
Evolve

Do we understand and agree
on WHAT are the needs?
A Lean Canvas serves as a container to
represent a speciﬁc need, and allow to have a
structured conversation with the stakeholders,
and agree on the objectives…

Merging agile and governance needs
Documenta(on
• Document
system
as-‐
built
• Opera)ng
procedures

serve
as
baseline
• DoR,
DoD
serve
as

minimal
requirements
• Document
is
part
of

product
increment

Automation (or DevOps)

Source
Inspection
Poka-Yoke
(Error-Prooﬁng)
Information
Inspection
Jidoka (Automation)
Judgement Inspection
Dr. Shigeo Shingo, co-
creator of the TPS
Avoid Errors
Find Errors
before they
become defects
Find Defects
Different types of inspection

ATDD
Unit tests
Component
Integration
tests
Performance
security, load
testing
Exploratory
& Usability
testing UAT
Q2
Q1
Q3
Q4
Business-facing
Technology-facing
Supporttheteam
Critiquetheproduct
Copyright
2009
Lisa
Crispin,
Janet
Gregory

ATDD
aka
BDD
aka
Story-testing
Business-facing
Supporttheteam

Write code to pass
the test
Add an
acceptance test
Fails?
Acceptance test
passes?
Acceptance
Test Driven
Development

Undefin
ed
Undefin
ed
Undefin
ed
- I want to be able to sync a
song with a click
Acceptance Test #1
Step 1 Step 2 Step 3
X
X
V
X
V V
V
- I want to add the song to my
“Favorite” playlist UndefinedUndefined
Acceptance Test #2
Step 1 Step 2VVV
Done!
Done is not an
opinion ;-)

Agile Engineering
Practices
Delivering fast requires new
methods... and new tools
People need to learn new
tools and new practices...

Add a test
Run the test &
check failure
Write code to pass
the test
Run tests see all
pass
Re-Factor
Re-Test
Test Driven
Development

TDDCycle Add an
acceptance test
Fails?
Acceptance test
passes?
Add a test
Run the test & check
failure
Write code to pass the
test
Run tests see all pass
Re-Factor
Re-Test
ATDD + TDD

“Inspection to ﬁnd defects is waste,
inspection to prevent defects is essential”
“If you ﬁnd bug regularly, you have got a
defective process”
Mary Poppendieck, Google Talk “Competing on the
basis of speed” Dec. 15, 2006
Defects are symptoms of a poor process

Agile Compliance is...

Cucumber – Process Validation – Why?
Dr. Christian BeckScrumMed 2013
“Any software used to automate any part of the device
production process or any part of the quality system
must be validated for its intended use, as required
by 21 CFR §820.70(i). This requirement applies to any
software used to automate device design, testing,
component acceptance, manufacturing, labeling,
packaging, distribution, complaint handling, or to
automate any other aspect of the quality
system. FDA General Guidelines on Software Validation“
FDA General Guidelines on Software Validation

Goals – Values - Principles
Principles stated in DIN62304, GGoSV,
Design Control Guidance*
Agile Principles & Practices
Conduct V&V throughout the SW dev
lifecycle
Incremental & Iterative Development
Ensure consistency of design artifacts Limit WIP, „Potentially Shippable“
Configuration Management / Document
Control
Configuration Management
Design input requirements are the result of
the first stage of the design control process
Backlog Grooming
Design input requirements should specify
what the design is intended to do while
carefully avoiding specific design solutions
at this stage
User Stories / Acceptance Criteria

Principles stated in DIN62304, GGoSV*,
Design Control Guidance**
Agile Principles & Practices
Traceability Limit WIP
Procedures (Standardization) Working Agreements / 5S
Create Evidence (Auditability) -
Independence of Review „multidimensional testing“
*General Guidelines for Software Validation
**Design Control Guidance for Medical Device Manufacturers
Goals – Values - Principles

Reader 1 Reader 2 Decision
- - „Well letter“
+ - ! Consensus Conf.
- + ! Consensus Conf.
+ + Recall
The quality of decision
is achieved by
collaboration and and
skillful integration of
diﬀerent mental
models
Example: Mammography Screening
Independent
Review
Collaborative
Problem
Solving
Independence of Review

The value of compliance is...

falling defect rates...

and less time ‘hardening’ the product

In conclusion

Conclusions
• Agility and IT Governance & Regulatory
Compliance share the same objectives
• Differences in HOW they are implemented
drives potential conﬂict
• Agility and Compliance can co-exist:
• Involve Compliance as involved
Stakeholder, providing reviews/direction
within Sprint
• Deliver compliance documentation as
part of product increment, codiﬁed within
DoD and automated tests
• Automate change tracking to reduce
compliance burden, and provide
comprehensive oversight

Thank you
dave.sharrock@agile42.com
@davesharrock
facebook.com/agile42

agile42 | We make your Agile transition succeed! www.agile42.com | All rights reserved. Copyright © 2007 - 2014.
Copyright notice
All material produced in this presentation is protected by the
Creative Common License 4.0 (by-nc-sa).

IBM Innovate2014 - Is Agile Compliance an Oxymoron?

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to IBM Innovate2014 - Is Agile Compliance an Oxymoron?

Similar to IBM Innovate2014 - Is Agile Compliance an Oxymoron? (20)

More from Dave Sharrock

More from Dave Sharrock (16)

Recently uploaded

Recently uploaded (20)

IBM Innovate2014 - Is Agile Compliance an Oxymoron?