Worse than Worthless . . .

Your people with prior CMM/CMMI experience are probably worse than worthless, they'll probably cause you to fail.

Why?

Because what they (or you) think they (or you) know is probably wrong and the advice you’re getting, the expectations being generated are entirely off base.

It all goes back to the many ways in which CMMI can be done poorly and the few, simple, but hard work ways in which it can be done correctly.

Every time I meet with a new prospect I’m confronted with reams of inaccurate assumptions and assertions about what it will take to implement CMMI and how am I expected to “do all that” and still claim to be “agile”.

My simple answer: I’m not going to do all that.  And, you shouldn’t be doing it either.

Seriously, you’ve got to wonder about executives who will force their company into doing stupid things for the sake of a rating instead of doing their homework to learn about CMMI before they head out on an implementation journey.

A recent client didn’t know any better.  They hired a consultant and an appraiser to evaluate their work against CMMI and to help them prepare for a SCAMPI appraisal.  Unfortunately, they got as far as the appraisal only to realize they weren’t going to get the target Maturity Level.  (I won’t get into some of the inappropriate behavior of the firm they hired.)

However, when this client was confronted with:

1. Do something stupid, or
2. Find a better way to do something smart.

They took option B and found a consultant and an appraiser who understood their context and found how to both be on a disciplined improvement path while also remaining true to their own business.

Fortunately for them, this client had a strong engineering backbone and knew what they did worked and were confident in their processes.  Many companies have a while before they can claim that much.

Next week:

Picking a Lead Appraiser:  "Dammit, Jim!  I'm a doctor not a bricklayer."

Prague Report: SEPG-Europe 2009

Despite half the attendance from 2008, the sessions were of very high quality and the size of crowd really facilitated an intimate setting to network, eat more than one meal with old and new friends and to have serious conversations about process improvement and the direction of SEI and its Partner network.

While it's not an entirely fresh thought, it really hit home for me the extent to which conferences -- and other concentrated spans of time, in general -- have the ability to shake loose new ideas. This conference, sometimes (I admit) unlike other events, I really spent an enormous amount of time and energy reflecting on all-things-process including my own work and company, collaborations, CMMI and other SEI products, and the SEI itself at a strategic level.

It's clear that when you spend that much time on learning, studying and inspection of ideas, the constant barrage of collisions and connections, that all sorts of (typically good) things can come of it. Really, I suspect that these not-so-obvious benefits all-too-often go under-appreciated, and under-utilized as secondary and tertiary returns of getting the most from attending conferences and of sending people to conferences. For my time (and money), these events have the potential to be far more value than mere training and seminars. And, this year's, SEPG-Europe really made me appreciate that.

The only event on Monday was a workshop on CMMI for Services which included several spirited discussions about model content and applications. An idea-generating session was conducted for how to address qualifications, continuing education, and related credentialing, for qualifying Partners to teach a new training class I'm helping develop in my role as an SEI Visiting Scientist. This discussion warmed up to even higher heart rates. (In a good way.)

Tuesday was the official tutorials day. My CMMI Crash Course could have gone better -- I was dreadfully under the weather from something I ate the night before. I also had it confirmed for me that the European crowd of novices is very different on many levels than American, British and other cultures. I couldn't get people to participate even with (mock) threats and jokes. They simply wouldn't open up. While they would ask questions at times, if I asked a question, they'd wait for me to answer it -- even when prompted them to answer. It came across as though one Danish student had more courage and better answers than the room full of working professionals.

While having the best of intentions to attend afternoon tutorials, I found myself back in bed, skipping lunch and dinner and only emerging once or twice to grab something to drink to stave off dehydration.

The exhibit area opened Tuesday evening, and I showed up with my shirt hanging out, no jacket or socks and looking very much like someone dragged me outside in the rain, hastily dried me off, then stuffed me into well-worn clothes. But, by the evening I was feeling better. Good enough to go down to the adjacent mall to buy 2 bottles of PowerAde. Once of which didn't even survive to see me emerge back out from the mall.

Wednesday, Thursday and Friday were the main conference days. Each one filled with excellent content. (You can download highlights here.) A former client of mine, Kevin Williams started my Wednesday day off with superb content on his (former) company's CMMI journey complete with metrics, examples, and lessons learned. It was a genuinely rich and rewarding example for how small and agile organizations can stay agile, use CMMI to benefit their work and get a desired rating. Kevin reported that despite having left the company and not having been replaced, the processes put in place under his leadership are still in use.

His session would have been better attended (by more people who really needed the information) had it not been for a slight oversight that left the word "Agile" out of his presentation and abstract. As a result, Kevin's 40-minute slot was opposite the start of a half-day tutorial on agile and CMMI from Tim Kasse who really put agile and CMMI under the engineering microscope -- at least while I sat in on the 2nd half of it, so I assume the earlier half was as hard-hitting.

It was hard to tear myself away from the excellent networking to get back into sessions throughout the week. Then, once I got back inside, there were other obligations keeping me from staying. For example, to go "play expert" for an "Ask the Experts" break-out, I had to bail out half way through Michael West's insightful work and thoughtful mini-tutorial (complete with hands-on exercises) on process design and communication.

The first keynote speakers started Thursday, but afterwards, the highlight of my Thursday sessions was John Hamilton's talk on complex process concepts for absolute beginners. He was highly energetic, entertaining, and very crammed full of excellent advice. I'm "borrowing" several turns of phrase from him -- which is only fair considering he borrowed a number of ideas (and words) from me. Fair trade. (Be flattered, John, I am!) ((John actually asked me about his use of the ideas at his company's recent conference -- where I also spoke.)) I believe it's from John that I tweeted about where the real improvement begins.

Friday. Ah, Friday. The way Friday got started was surely a sign of good tidings. Tony Devlin's keynote was simply inspiring. My tweets (also) from it don't even tell the half of it. Talk about true maturity. Do they *get* this stuff or what?! I can't even bring myself to write about it out of fear of not having time to sleep tonight once I start. I expressed my thanks afterwards and expressed a request for learning from them and extended an open offer to answer questions from my experience in return. He graciously provided me with his email address and said he'd bare all. Then to have had lunch with him was a real treat. I was already eating with 2 SEI personnel (including Mike Philips the program manager for CMMI), and with one open space, Tony asked to join in. After making a fool of myself over light banter -- in which I forgot an actor's name, thereby forgetting his nationality, and only remembering that he portrayed an Irishman in a movie, causing me to think he was Irish, only to be admonished for confusing Irishmen with Scots when someone recalled the actor for me -- we got back to discussing his experience and solidified our intent to exchange information.

Friday was no where nearly done. A session on multi-model collaboration by Kobi Vider-Picker was incredibly well-researched and his audience was full and attentive. He basically laid-out how well the CMMI suite can handle dozens of standards, guides, regulations, etc. I understand he doesn't need to sleep or eat much. It must be how he finds the time between all his work to do such thorough research. The next session was by Malte Foegen, the tweet from that session set off a chain-reaction of re-tweets. Probably my longest ever.

Lastly, my mini-tutorial based on the SEI Technical Note probably had about a third of the entire attendee roster. Of course, by 4pm on Friday, nearly the entire roster had already started out for the airport. By this point, people were more open to volunteering discussion. Nonetheless, I was struck by how deeply ingrained certain ideas about CMMI (and Agile) have been etched. Despite months of promoting the subject since the publication (years prior to that online); despite the availability of the Crash Course, and other sessions from other events, despite all the presentations throughout this and other SEPG events, and for many, having sat through the Crash Course just days before . . . some misperceptions about CMMI and Agile (such as how certain practices "must" be done, or what constitutes "evidence", or that process definition is process "restriction") just are almost too hard to give up.

There is work ahead still.

I'm on it.

Seat-backs and tray-tables . . .

A few weeks ago, I blogged about a frustrating incident in an organization created a bureaucratic procedural approach to achieve the desired policy outcome rather than to create a process that would empower the people performing the activity to ensure that the policy was met in the most efficient manner.

That post caused a series of interactions with someone who took issue with my post and assumed the position to defend the procedure I was annoyed with.  I believe we left the matter at a point of agreeing to disagree.

Perhaps this post will cause a different group to take issue with me, but many more people are likely to relate to the content so I can convey the topic of policy-process-procedure in a different way.

A few days ago I found myself in an airline row with 3 seats to myself from the aisle to the window.  As a frequent flyer I automatically ensure that my seat-back is forward and my tray-table is "in its upright and locked position" at all the expected points in the flight profile.  But this time, when it came to landing, it got me thinking (again) about the policy-to-procedure "food chain".  Something seemed a bit over-kill-ish and I wasn't sure at first why.

In particular I was ruminating on the requirement to put your tray-tables up and bring your seats backs forward during ground operations, take-off and landing.  Why?

So I started with the question: what could this requirement be fulfilling?

That's easy: Safety!

But then: what is it about safety that this specific requirement fulfills?

That's easy too: Avoiding injury in case of getting tossed about in the cabin plus the need for people to be able to get out of the plane in case of emergency.

OK.  But still: what's going on that would lead to someone getting injured and/or being impeded from getting out of the plane in an emergency?

And that is when I realized what's going on.

The requirement to put our seat-backs forward and our tray-tables up *is* over-kill in certain situations.  Well, the tray-tables part really is NEVER over-kill.  That's *always* a good idea.  But, specifically, I was thinking about the seat-backs part as sometimes over-kill.

Like in the situation I found myself in.

Airlines have to comply with the FAA's regulations and create their own policies to do so.  In fairness, I have not read the FAA's regulation on this, but since I am learning to fly, I'm generally familiar with the way in which flight regulations go.  Where it concerns passengers, the regulation is about safety, and it isn't up to the FAA to tell airlines exactly how to make that happen.  Airlines don't have to give you seats that recline, or tray tables to put your things onto.

So the airlines come up with policies to ensure they comply with the regulations.  And, then the airlines come up with processes to execute the policies and procedures to perform the processes.  Or, often, they just skip the process part and jump right into procedures.

You see, bringing up our seat-backs is a procedure intended to ensure a policy (and a regulation) is fulfilled.  But the policy (and the regulation) can be fulfilled in other ways.  Yet the airlines don't provide flight crews with any other way and as a result, passengers are (sometimes) inconvenienced. 

Had the airlines created processes instead of procedures, then bringing up our seat-backs would be a function of whether or not anyone would actually be impeded by having our seat-backs reclined.  In the situation a few mornings ago, not only did I have an entire (half) row to myself, but the half row behind me was empty.  With no one next to me, no one behind me and an exit row several rows away, I could have left my seat all-the-way back and not bothered anyone's attempt to get out of the plane in an emergency, I could have rested more comfortably during landing, and I wouldn't have wasted a flight attendant's time asking me to put my seat up (which didn't happen since I did it anyway -- but I'm just sayin').

However, I'm not about to advocate for a change to airline policy on this point.  Really, there are many other factors to consider, and six seats with only one passenger in them isn't common anymore so the likelihood of not needing to put-up our set-backs is rare.  The procedure is nearly 100% appropriate and for the less than 1% of instances where a better process would have helped, it's entirely NOT worth it.  I'll suffer.

In all honesty it wasn't a big deal at all.  In fact the observation was merely mental gymnastics for me, but it did serve as good fodder to help explain the difference between policy, process, and procedure.

PERFECT example of bureaucracy vs. process

What is the world coming to?!  Two posts in a month?

Well, when life hands you perfectly fitted, hand-picked, juicy, gift-wrapped, actual too-good-not-to-share learning-rich examples on a silver platter... you've just gotta take 'em and share 'em!

One such example was handed to me a little while ago -- thanks to the US Department of State via the US Postal Service. 
No, the Postal Service didn't deliver something to me from the State Department.  It's more like the Post Office was the instrument of the State Department's bureaucracy.

A perfect duet of two bureaucracies operating in perfect bureaucratic harmony.  Though, when I think of "bureaucratic harmony" it sounds like an out-of-key dirge played in a decaying public school building by a poorly equipped elementary school ensemble.

But, enough of the musical analogies... We've got a bureaucracy to pick on and how and why my experience at the post office that week provided me such rich fodder for a blog post about processes.

This experience crystallized a way to teach the distinction between: Process, Procedure, and Bureaucracy.

So, the context of the lesson is in the State department's requirement to verify the parentage of minors (children under 16) applying for a US Passport.  To avoid issuing passports to minors (or in particular, to adults in the company of minors), the relationship between the minor and the adult must be established.  In a typical example, parents must demonstrate that they are, in fact, the children's parents.  When applying for a passport for a child, parents must show that (a) they and their children are US citizens and that (b) the children belong to them.  The State department requires that the children and both parents be present while applying and that the parents supply the child's birth certificate.  So far so good.

The lesson appeared when we were applying for a passport for a child for whom we already had a passport.  In other words, we'd already provided the necessary documentation to prove we are our child's parents when we first obtained the passport.  We appeared at the post office with an expired passport in hand and all the other documentation, except for the birth certificate (for the child who already had a passport, and thus we'd already proven our relationship).  Since we'd already provided the birth certificate in order to obtain the original passport, we figured the post office merely had to ensure that we were still who we said we were by looking at our government-issued ID (which is also required when applying).

Even if there was risk of someone else finding our child's passport and attempting to represent themselves as our child's parents, their IDs wouldn't match the names, and even if they did, in such a case whether or not they were *us* wouldn't matter.  Imposters with that level of sophistication could get anything they needed.  But, under normal circumstances, if someone else were to try to pass themselves off as us, their names wouldn't match up.   In other words, if adults show up claiming to be a child's parents, then their names should match that on the application and the child's documentation.  If the names don't match, then additional documentation would be appropriate, as in the case of adoption or other name-mismatching situations.

Anyone can buy a birth certificate, so, in fact, the longer we exist, the better the chances of identity theft.  Therefore, the earlier someone gets a passport, the more likely it was obtained with authentic data.  So again, the best "proof" that we are our child's parents is the fact that we had a prior passport along with the other documents.  However, the State department's bureaucratic procedures, dutifully executed by the Post Office, required that we present a birth certificate nonetheless.

At Entinex, we define a Process as the high-level depiction of a value-adding activity that produces an outcome.  Processes are the activities that are necessary for the product being worked on (or work being done) to achieve the outcome the customer of the work desires to have.  If the proper outcome is achieved, as long as the cost and schedule was within the customer's expectations, the customer ought not care how the outcome was achieved.  The process can be the same from context to context.  In fact, minimizing unique variants of a process in a given organization makes it easier to manage.  In our passport example, if the State department had issued a process rather than a procedure the process would simply be: Establish and Confirm parent and child's identity, relationship and citizenship.

The how of the process we define as a Procedure -- the specific steps needed by the process to produce an output.  There are likely many ways (i.e., many possible procedures) to accomplish the process' expectations.  Procedures are best applied to very particular contexts and ought to change from context to context.  From a value stream perspective, procedures actually consume value.  The intention of any organization ought to be to minimize the gravity of the procedure since if/when the procedure takes more time or resources, it costs more and therefore raises the cost of the process and often reduces its value.  Procedures are served best minimally.  Had the Post Office been allowed to create their own procedure(s) to accomplish the above process, they could have created procedures to check for artifacts that identity has been established/confirmed by means of some level of reasonableness.  The Post Office could have different procedures for first-time applications, subsequent applications, and name-mismatches.

However, instead, the State Department issued a procedure that was not context specific and wasteful.  It didn't give the Post Office (or anyone else) the flexibility to find the most appropriate way to determine identity or relationship, or to distinguish between the permutations of application situations.

In other words, the State Department established a bureaucracy:  A procedure in absence of context. 

Bureaucracies are often intended to compensate for lack of competence or trust, or as input to an over-engineered system.

Take your pick on this one.

I'm about to say something cliché...

... Expect to learn all the time, and you will learn.

I'm working with a great client in Connecticut.  A referral thanks to Bob Lewis.

First off, over coffee Bob unknowingly gave me a new set of metaphors for a topic he admits to having little understanding of: CMMI.

To spare you the details of what he said and how I processed it, please allow me to simply explain the gist.  In CMMI there are lots and lots of things called "practices".

Many people interpret these practices as though they are processes, or worse even, procedures, and they execute the practices mechanically.  Yes, that's usually because these same people either (a) are chasing a maturity level rating, or (b) simply don't understand how to use the model to reap the greatest benefit, or often, (c) both a & b.

Here's how to actually and properly use the practices in CMMI:

They are underlying motivations.

When you think of what doctors, lawyers, athletes and performers do, they practice their art.  And it's a practice because they're constantly applying, learning, adjusting, and responding to the non-ideal and unpredictable conditions presented to them in real-time.  If they were simply following procedures every time, they'd fail most of the time.  Yet, they practice, practice, practice, so that when it comes time to perform the practice they aren't worried about following pre-determined procedures because they must be able to respond to what's thrown at them in reality.  The procedures assume a pre-determined situation and the responses to procedures are ideal to those situations.  What they're exactly doing in real-time comes from their practice, but doesn't necessarily look exactly like what they did last time.

Procedures are good when all the inputs are controllable.  Processes help know what major transformations an object or an idea must go through to become an outcome.  Processes generally follow an expected sequence, but what happens inside the process should have enough flexibility to be rearranged to meet the needs of or to normalize the input conditions.  What the procedures must do, however, is respond to reality.  The way in which procedures inside a process respond to reality to become rearranged or redefined based on the principles and motivations of practices; which are not necessarily even explicit.  They're "just there".

For example, at the process level, a doctor goes through several steps prior to, during and after performing surgery, (e.g., consult, exam, test, analysis, advise, prepare, communicate, operate/investigate, clean/close, protect, follow-up...). Each of these sub-processes to the process may have certain procedures, but each of those procedures is contained within at least one practice.  The practice may not even be written, or formal, but they're certainly part of what the doctor is trained to do based on principles and motivation.  These principles and motivations are taught and refined over time, with practice.  And true, some practices can be beyond the capability and/or maturity of some people.

It's no wonder when an organization's true underlying motivation is the shallow ceremonial decoration of a rating that their results are equally shallow despite the time, energy and money that went into the production effort to pull off ceremonial decorations. (Think: big, gaudy, wedding where everyone knows the couple won't last.)

While learning this lesson, Bob pointed out that what he and I do for a living are, in fact, practices (i.e., consulting practices) and the next morning I find myself before a cozy crowd of client staff and despite having thought through much of how things would go, I still felt like I was winging most of it.  In reality, in real-time, I *was* winging it.  I was responding to the reality, but was never out of my element because I was still.... practicing.  Following the basic principles and motivations to achieve an outcome.

So it all worked out and everyone was pleased.  We made a lot of progress and then I learned the next lesson in this 24 hour period of time: It's really a lot of fun to actually be on the sharp end of the stick once in a while... actively blending Scrum and the immediately useful bits of CMMI.  The real lesson, though, was in gaining re-enforcing validation as I witnessed this organization actively absorb and propose process ideas.  There was no push-back.  Quite the opposite.  Processes were being embraced as one of the things that would lead them towards success.  The alternative would be a slow dissolution of the company.

Once in a while it's nice to really see just how effective blending good ideas can be when this process stuff is put into context of what must be done to succeed.  It just demonstrates again that too many organizations are using CMMI for the wrong reasons made worse by a lack of practice.

What's in a Policy?

This post is part gripe part informative.

Let's start with the gripe (it's also informative).

Two of my kids go to a pre-school with the following inclement weather policy:
(Only the names of the places have been edited. Otherwise, this is verbatim.)

INCLEMENT WEATHER PROCEDURE

1. Our policy is based on [B] County School Announcements. We do not make specific [OurSchool] Announcements.


2. If [B] County Schools are closed due to inclement weather, our school will follow the same procedure.


3. If public schools are opening one hour late, we will open on time. There will be no before school care.


4. If public schools open 2 hours late, we will open at 10:00 AM. There will be no before-school care. The morning session will end at 12 Noon.


5. If public schools open more than 2 hours late, we will open at 12 Noon for extended day children.


6. If [B] County closes early, we will also close.


7. If inclement weather develops while the children are in school, it may be advisable to close school early. Listen to your radio for [B] County closing announcements. Parents concerned about inclement weather should pick up their children as soon as possible. Working parents are responsible for making arrangements to have their children picked up on time.


8. Our facility is air-conditioned in cases of extreme heat.

Inclement Weather Procedure
Please read carefully.
There have been changes to our policy.

Notice anything strange?

How about they don't know the difference between a Policy and a Procedure. (Don't even get me started on where "process" fits into this!)

How about the problem that what their "policy" boils-down to are:
a) we don't have a policy,
b) we follow what the County does,
c) except when we don't.

In reality, how this "policy" plays out is this: If/when (and it *has* happened) that our kids' school decides to not follow the County's lead, they have no reliable way of notifying parents. They expect us to either call them, monitor email, or just show up. The issue with calling them is that they've got about 100 families of kids at their school. Not like 20 in a daycare.

Here's another problem. Today, public schools were closed for Primary Elections (our County uses the public schools as voting locations), and, there was inclement weather. How exactly was the policy going to work today?!?!

Don't think I haven't brought this to their attention from the very first time the first of my kids attended that school. Of course, I was ignored by the school administration. To say that my concerns were "dismissed" as insignificant details would be giving them too much credit for even comprehending why my observation was even an issue.

So, here's the "informative" part of the post.
And, the "agile" connection.

A policy is little more than a charter for doing something. When it comes to processes and process improvement, the policy gives "teeth" from upper leadership to the performance of the processes by projects. Existence of policies for doing a process are the first indication that processes are being worked into the fabric of an organization. In CMMI, being worked into the fabric of an organization is called "institutionalization" and is carried out by performing the Generic Practices. Since "being worked into the fabric of an organization" is about making an impact on the organization's culture, I like to call this aspect of process implementation, acculturation.

Here are some other hints and tips for policies:

• They don't include processes or procedures, though they may reference them for clarification, edification, or example.


• They could easily be replaced with a "charter" if that works better for your organization.


• They shouldn't be so weak as to be rendered obsolete or useless under the strain of simple integrity (read: "smell") tests.


• Someone should care whether the policy is followed because having the policy ought to be essential in helping the organization and its stakeholders make decisions and be predictable.


• Policies should be clear about what's expected of people's conduct and performance (which makes them *not* the same a vision or mission statements -- if it reads like one of those, it's not a policy).


• They can actually be carried out, and you know when they aren't, and when not it's either very unusual, or, someone's not gonna be happy.


• Suggest a certain priority of activities, and when in doubt or when conflict arises, the policy should help sort through it, or at least let those operating under the policy know when they're in unchartered territory so they can seek leadership input.
  And, most importantly,


• Policies set expectations, not steps, not work-flows, not checklists.

In agile organizations, or in "traditional" organizations looking to become "agile", look to policy to ensuring minimal 'prescriptiveness' or, respectively, a source of unnecessary limitations, restrictions and undue 'proceduralizing'.

In our experience, our kids' school isn't alone in having intractable policies. Only, when our kids' school ran into me, they were up against someone who actually thought having a "policy" meant something.

Silly me.