Agile Methods and Process/Quality Standards

June 15th, 2010 No Comments

Several readers of my previous posting about agile methods and software quality have asked: is it possible to follow an agile process and still comply with process and quality standards such as ISO 9001, TL 9000, and the Capability Maturity Model Integration (CMMI)? The answer is: it depends. In a nutshell, agile methods give the development team a great deal of freedom as to what activities to carry out; if they choose activities, including documentation and review/approval, that conform to the standard, then they can claim conformance and obtain any certification that may be available.  They may also find that the practices put into place to achieve compliance actually improve their software development performance.

Not surprisingly, the question of the compatibility of standards with agile methods is of great interest to organizations that have been compliant and/or certified to a process or quality standard. As the demand for the benefits of Agile increases, management wants to know if they can maintain conformance while using an Agile method. There are also situations where an organization that had been following an agile process became interested, perhaps because of customer demand, in complying with, and perhaps obtaining a certification to, standards such as ISO 9001.

One obstacle to standards compliance of agile processes is the general disrespect, even hostility, that those in one camp have for the other. It’s quite common for adherents of agile methods to dismiss process and quality standards as needless bureaucracy, and for advocates of ISO, CMMI, etc., to refer to agile methods as little better than hacking. There are benefits to both agility and standards, and if we can get past this lack of communication, I believe we can get the benefits of both into our software development.

Is it possible to meet the process requirements of one of the standards and still maintain the spirit of minimal overhead that motivates agile methods? Perhaps the key is to determine what aspects of the process and documentation are essential–actually contribute value to the ultimate product–and what aspects have a cost that exceeds their benefit. Then, depending on how prescriptive the standard is, the essential or high-value process elements may be sufficient to conform to the standard. Agile adherents will need to be convinced that the process elements–especially the documentation requirements–are really necessary and beneficial; process adherents need to be convinced that the activities that are dropped do not provide benefits exceeding their cost, or at least be willing to let it be tried out.

There are a good number of examples in the literature of how processes were designed to retain the attributes of an agile methodology (usually Scrum but occasionally Crystal or Extreme Programming [XP]) and still be compliant to a standard such as ISO 9001 or CMMI. I’ll cite a few examples and, if there is sufficient interest, I can walk through one of the approaches.

Hillel Glazer has made an extensive study of the intersection of Agile Methods and CMMI. Many of his results are presented on his blog.  He also provides links to other relevant papers such as this one by Mike Konrad and Jim Over of the Software Engineering Institute (developer of the CMMI) in Dr. Dobbs’s Journal: “Agile CMMI: No Oxymoron.” Also of interest is Glazer’s CMMI FAQ.

It’s also worth noting that the upcoming Version 1.3 of the CMMI, due in November, specifically addresses agile methods: how to interpret CMMI practices that may not seem applicable to agile development.

Primavera Systems (a developer of project management software, acquired by Oracle in 2008) established a quality management system that conformed to ISO 9001 while retaining its agile (Scrum and XP) development approach. Primavera did not formally register to ISO 9001 as its customers were only asking for the practices, not the certification; interested customers may review the process and documentation to confirm conformance to the standard. Primavera found that the process improvement and compliance assurance that resulted from this effort improved its development practices as well as meeting customer requests; also in-process defects decreased, and product quality, as measured by reported defects and customer surveys, improved. A paper, presented at the Agile 2007 conference, described Primavera’s efforts; there is an accompanying presentation.

The Norwegian University of Science and Technology (NTNU in Norwegian) and The Foundation for Scientific and Industrial Research (SINTEF in Norwegian) collaborated in a study of how agile methods and ISO 9001 were compatible and how they conflicted. The results were presented at the Ninth International Conference on Product-Focused Software Process Improvement in October 2007, and can be found at this URL; if the URL does not work, cut it off at “lectureplan” and click on “The application of…” They conclude that ISO is very prescriptive in some areas such as (1) requiring a complete review of requirements before committing to development and (2) requiring documentation of all changes to design and development plans. Agile methods typically start with an incomplete set of requirements and refine them as development progresses, and document these changes only informally. NTNU/SINTEF didn’t identify a solution to the problem but concluded with a statement that both agility and ISO are too important to be ignored. From my experience, it is possible to start with a “goal” set of requirements and suitably document any changes made during development.

A paper published in 2006 in a journal of the Conferencia Latinoamericana de Informatica looks at the applicability of agile methods to CMMI compliance (and certification). The authors show how Level 2 of CMMI can be met by combining activities from several agile methods.

Additional references on the subject of agile methods and defined software processes are:
http://www.agile-itea.org/public/deliverables/ITEA-AGILE-D2.9_v1.0.pdf
http://www.tickit.org/ti3q02.pdf (the first of the two articles)

Be Sociable, Share!

Leave a Reply