Processes: Auditing, Analysing and Implementing

1. Dennis Adams a s s o c i a t e s Processes: Auditing, Analysing and Implementing An approach for implementing Appropriate Management Processes into IT Production Dennis Adams Associates LimitedConsultancy for IT Production Managementwww.dennisadams.net

2. Introduction: MOPS for IT Production • There are four key elements which we consider are necessary for Strategic- & Proactive- Management of IT Production: • METRICS • OPERATIONAL TOOLS • PROCESSES AND PROCEDURES • STANDARDS • This presentation will cover how we would approach the topic of Processes and Procedures, in the context of IT Production Management. • Many of these techniques are based on ISO 9000 Guidance. • “ISO 9000 Introduction and Support Package: Guidance on the Concept and Use of the Process Approach for management systems” (ISC/TC 176/SC 2/ N544R2)

3. MOPS Auditing M • “MOPS” auditing involves systematically looking at the Organisational structure of an IT Production team, and measuring it’s viabiliy against the MOPS criteria ; • METRICS • OPERATIONAL TOOLS • PROCESSES AND PROCEDURES • STANDARDS • This presentation will concentrate on the “Processes and Procedures” side of a MOPS audit. • NOTE: This is not a manual on how to do a MOPS Process Audit. It covers the general Approach. See other documentation for: • Criteria for appropriate Processes within IT Production • Specific questions to ask • How to do Gap Analysis O P S

4. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

5. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

6. What is meant by “Process” ? • The ISO 9000 guidance defines a process as a “set of interrelated or interacting activities which transform inputs into outputs” • Inputs and Outputs could be • tangible (equipment, materials, components) • intangible (energy, information). • Some Outputs could be unintended (waste, pollution). • Each process has “customers” or other interested parties who may be internal or external to the organisation. • Are affected by the process, and • Define the required outputs according to their needs and expectations • All processes should be • Aligned with the objectives of the organisation • Designed to add value relative to the scope & complexity of the organisation.

7. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

8. Types of Processes • The ISO Guidelines identify the following types of processes: • Realisation Processes • Processes which provide the intended output of the organisation • Processes for Management of an organisation • E.g. Strategic Planning, establishing Policies, setting Objectives, providing Communication, ensuring Availability of resources needed, Management reviews. • Measurement, Analysis and Improvement processes • Processes to measure and gather data for performance analysis and improving effectiveness and efficiency. E.g. Measuring, monitoring, auditing, corrective & preventative action. • Processes for managing Resources • For provision of resources that are needed for any of the above

9. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

10. Organisation and Process • Organisations are usually hierarchically organised “vertically” by Functional units: • E.g. Unix/Window Engineers, DBAs, Network, HelpDesk etc. • Actions are usually focused on the function of the unit. • Problems that occur at the interface between units are often given less priority than the goals of the unit itself. • The “end customer” is not always visible to all involved. • E.g. a problem application arrives at Help Desk, and is passed between each team in turn, all of whom pass it on as “not a problem from my perspective” • One solution is to create a multi-discipline SWAT team to address the problem holistically. • The “Process Approach” introduces horizontal management.

11. The “Process Approach” Functional Organisation Process Approach The Process Approach introduces horizontal management, crosses the barriers between different functional units and unifying their focus to the main goals of the organisation.It also improves management of process interfaces.

12. Using the “Process Approach” • “The Performance of an organisation can be improved through the use of the process approach. The processes are managed as a system, by creating and understanding a network of the processes and their interactions.” (ISO 9000 Introduction and Support Package) • The consistent operation of a “network of processes” and their interactions is often referred to as the “system approach to management” • (Not to be confused with the management of systems !) • Outputs from one process may be inputs to other processes and interlinked into the overall network of processes.

13. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

14. Auditing the Processes within IT Production • The ISO 9000 guidelines suggest the following steps can be followed to identify the processes within an organisation: • (5.1.1) Define the purpose of the organisation. • (5.1.2) Define the policies and objectives of the organisation. • (5.1.3) Determine the processes in the organisation. • (5.1.4) Determine the sequence of the processes. • (5.1.5) Define process ownership. • (5.1.6) Define process documentation. • (Numbers in brackets are from N544R2 guidance) • In detail…..

15. Define the Purpose of the organisation. • Identify the customers and other interested parties • Their requirements, needs and expectations • Define the organisation’s intended outputs. • Gather, analyse and determine customer and other interested parties requirements, and other needs and expectations. • Communicate frequently with customers and other interested parties to ensure continual understanding of their requirements, needs and expectations. • Determine the requirements for different management disciplines within the organisation (quality, environmental, health & safety, business risk, social responsibilities) In IT Production, our “customers” are the business and other IT departments. We need to be clear on their requirements, needs and expectations.

16. Define the Policies and Objectives of the organisation. • Based on analysis of the requirements needs and expectations, establish the organisation’s policies and objectives. • Top management should decide which markets the organisation should address and develop relevant policies. • Based on these policies, management should then establish objectives for the intended outputs. An IT Production division does have the ability to “scope” it’s “market” to some extent. Some activities (e.g. desktop support) may already be outsourced, or could usefully be. If the business intends to expand into new physical locations, will the current IT Production be given responsibility for these?

17. Determine the Processes in the organisation. • Identify all the processes that are needed to produce the intended outputs. • Determine the processes needed for achieving the intended outputs. The process types are: • Realisation • Management • Measurement • Resource • Identify all process inputs and outputs • Identify all suppliers, customers, and other interested parties. Many IT Production organisations have “implicit” processes, embedded in the culture. If these can be identified, they are a strong basis for building on.

18. Determine the Sequence of the processes. • Determine how the processes flow in sequence and interaction. • Define and develop a description of the “network of processes” and their interaction.Consider the following: • The customer of each process. • The inputs and outputs of each process. • Which processes are interacting. • Interfaces and what are their characteristics. • Timing and sequence of the interacting processes. • Effectiveness and efficiency of the sequence. • E.g. a Realisation process will interact with a Management, Measurement or Resource Process. • Block diagrams, matrix and flowcharts ! Looking at the Sequence of Processes within IT Production (e.g how and when we Measure the Realisation processes) can bring valuable insight into how efficiently we are achieving our objectives.

19. Define process Ownership. • Assign responsibility and authority for each process. • Management should define individual roles and responsibilities for ensuring the implementation, maintenance and improvement of each process and it’s interactions. (The “Process Owner”) • To manage process Interactions, it may be useful to establish a “process management team” that has an overview across all the processes, and which includes representatives from each of the interacting processes. The is considerable benefit to an IT Production team in making “implicit” (“cultural”) processes explicit, and assigning someone to be responsible for them. External consultants who understand IT Production may be in a position to help do this.

20. Define process Documentation. • Determine those processes that are to be documented and how. • Processes already exist within an organisation, and the initial approach should be limited to identifying and managing them in the most appropriate way. There is no necessity for a massive global “catalog” of processes. • The main purpose of documentation is to enable the consistent and stable operation of the process. • Determine which processes are to be documented based on: • Size of the organisation and the type of it’s activities • Complexity of the processes and their interactions • Criticality of the processes • Availability of people to do the documentation ! • Graphical designs, written instructions, checklists, flowcharts, visuals… interactive web sites.

21. Auditing - Summary • Auditing Steps: • Define the Purpose of the organisation. • Define the Policies and objectives of the organisation. • Determine the Processes in the organisation. • Determine the Sequence of the processes. • Define process Ownership. • Define process Documentation. The result of this activity would be a “Process Landscape”, which would show us what processes are already in place, and help us identify the gaps. From an IT Production perspective, we should have a clear understanding of our purpose, policies and objectives, so we need to concentrate on the “Gap Analysis”

22. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

23. “MOPS” Questions • A key part of the “MOPS” approach is to implement solutions based on a pragmatic understanding of the real issues in IT Production. • Process implementation needs to focus on the Objectives of IT Production. • Typically, this involves efficiency and effectiveness. • At the same time, it may be possible to look at Operational Tools as a means of automating the processes.

24. WHERE do we WANT to be ? • Visibility of Activity to identify the "problem applications" that take a disproportionate percentage of support effort. • This enables the Business as a whole to understand the true lifecycle costs of all Applications. • Predictable Cost growth (such as headcount), and Infrastructure costs (such as CPU, memory, disk storage etc.) • so that resources and infrastructure can be purchased in good time, with appropriate cost savings. • Clear Infrastructure Standards and Service Levels • So that IT Development can understand what technologies can be supported by IT Production, and at what costs.

25. THE DREAM of Strategic IT Production • Smooth deployment of Projects, as a result of clear handover procedures to IT Production, and IT Production's involvement with Projects at Initiation side, to ensure that Support is viable. • Justify the IT Production Budgets against clearly agreed Performance Metrics. • Engage with the Business sponsors, and successfully argue the case for increasing IT Infrastructure Investment, rather than fighting up-hill budget reduction policies that don't take into account Infrastructure needs. • Function as a “Managed Team”, rather than just event-driven "fix-it ". Using a Strategic Approach, IT Production Managers can make their teams more Pro-Active more Client-focused, and be in a better position to justify IT Infrastructure Investment

26. PROCESSES and PROCEDURES should: • Facilitate the day-to-day running of IT Production, and it's relationship with the Business Sponsors and IT Development • Facilitate rapid Deployment of Projects to live, upgrade, change controls processes etc. • Enable changes to Production Standards (hardware & O/S upgrades etc.) and procedures to ensure that IT Development work and Business Sponsorship is visible to the IT Production team. • Enable a clear interface with Development Projects at the earliest possible phase. Don’t overload your teams with Procedure. Use a pragmatic common-sense approach.

27. The BEST WAY to Implement ITIL Service Management? Service Desk Incident Problem Change Release Configuration Configuration Management Database (CMDB)

28. …or MORE LIKE THIS ? Service Desk Incident Problem Change Release Configuration Configuration Management Database (CMDB)

29. Gap Analysis • Once we have identified the current processes, we can use the ITIL framework (or BS 15000 or CMMi) to identify the gaps. • Note, however, that we should concentrate on the overall IT Production department as a whole. • It is important that we understand where the “inputs” and “outputs” of IT Production exist. • Problems with Process typically arise in the Interfaces to those processes, not the processes themselves.

30. PROCESSES / PROCEDURES to IMPLEMENT • ITIL Service Management provides a valuable framework within which to define your processes: • Service Desk, Incident and Problem Mangaement, • Change and Release Management • Configuration (Asset Management) • In Addition, it is important to highlight the Process INTERFACES between IT Production and the outside world. • Project Deployment, Handover. • Involvement with Production at Project Initiation, linked to Standards • Sponsorship of R&D within the Production team.

31. INTERFACING PROCESSES Initiation R & D Configuration Build Release Standards Change AGILE Problem Deploy Handover Incident Support Service Desk

32. Reminder: Advantages and Disadvantages of PROCESSES • Advantages of Process: • SOX, CMMI, ISO 9001, ISO 10000-3 • Reduction in Costs • Predictable, Repeatable, Auditable, Verifiable • Disadvantages: • Can become onerous • Not always reflecting the need to be highly responsive. • Conclusion: • Deploy Processes which deliver value-add to IT Production and it’s clients.

33. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

34. Implementing New Processes within IT Production • The ISO 9000 guidelines suggest the following steps can be followed to plan a new process within an organisation: • (5.2.1) Define the activities within the process. • (5.2.2) Define the monitoring and measurement requirements. • (5.2.3) Determine the resources needed. • (5.2.4) Verify the process and it’s activities against planned objectives • (Numbers in brackets are from N544R2 guidance) • In detail…..

35. Define the Activities within the process. • Determine the activities needed to achieve the intended outputs of the process. • Determine the required Inputs and Outputs of the process. • Determine the activities required to transform the inputs into the required outputs. • Determine and Define the Sequence and Interaction of the activities within the process. • Determine how each activity will be performed. • (In some cases, the customer may specify the way the process is to be performed) It is helpful to think of IT Production Processes as Transformations from an input (“a support call”) to an output (“a satisfied end-user”)

36. Define the Monitoring and Measurement requirements. • Determine where and how measuring and monitoring should be applied. This should be both for control and improvement of the processes, as well as for the intended process outputs. • Determine the need for recording results. • Identify the measures and and monitoring criteria for process control and process performance, to determine the effectiveness and efficiency of the process, taking into account: • Conformity with requirements • Customer satisfaction • Supplier performance • On time delivery • Lead times • Failure rates • Waste • Process costs • Incident frequency

37. Determine the Resources needed. • Determine the resources needed for the effective operation of each process. • Examples of resources include: • Human Resources • Infrastructure • Work Environment • Information • Natural Resources • Materials • Financial Resources. There may be Resource Trade-offs IT Production Service Support may be “manpower intensive”. Provision of a “test lab” environment for reproducing problems could reduce manpower costs drastically.

38. Verify the process and it’s activities against planned objectives • Confirm that the characteristics of the process and it’s activities are consistent with the purpose of the organisation. • Verify that all the requirements identified earlier are satisfied. • If not, consider what additional processes may be required. • How can the process be improved? Our objective as an IT Production team is to deliver the best possible support function to the end-users. Appropriate Processes can be a valuable means to this end.

39. Additional Factors when Implementing Processes • When implementing new Processes, you should also consider how to address the following: • Communication of the new Processes • Awareness • Process Training for the “actors” • Change Management • How to change the current processes (if any) into the new ones. • Management Involvement • Review Activities after the processes have been implemented. • Are the appropriate Measurement, Monitoring and Controls in place ?

40. Implementing - Summary • Implementation Steps: • Define the activities within the process. • Define the monitoring and measurement requirements. • Determine the resources needed. • Verify the process and it’s activities against planned objectives • Additional Factors In practice a Small number of Simple processes, communicated, understood, adhered to and maintained, are of more benefit than A Large number of Complex processes not communicated, not understood and never followed !

41. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

42. Evaluating the Success • Before embarking on work to audit and implement new processes, it is important to have pre-defined success criteria. • Evaluate the process data (obtained from the Monitoring and Measuring processes!) to quantify process performance. • Compare the results of process performance measurements with the defined requirements of the process: • Confirm process effectiveness & efficiency • Any need for corrective action • Identify process improvement opportunities based on process performance data. • Report to Management on the performance of the Process. IT Production can enhance it’s visibility and credibility by reporting on process improvements it has implemented.

43. Improving the Processes • As well as implementing new processes, we should also define a method for implementing corrective actions / improvements. • If the process is not “working” what are the root causes? • Human errors? • Defect in the process itself? • Insufficient process control? • Once the process requirements are achieved, focus efforts on improving them ! • Define a method for improving processes: • Process simplification • Enhancement of efficiency • Improvement of effectiveness • Reduction of process cycle time. • Verify the effectiveness of the improvement.

44. Risk Analysis • Risk Analysis techniques can be used to identify potential problems with our new process • Identify the root cause(s) of these potential problems • Address the root causes. • This may prevent occurance in other processes with similarly identified risks. IT Production can enhance it’s visibility and credibility by reporting on process improvements it has implemented.

45. “Plan” Establish the objectives and processes necessary to deliver results in accordance with customer requirements and the organization's policies; “Do” Implement the processes; “Check” Monitor and measure processes and product against policies, objectives and requirements for the product and report the results; “Act” Take actions to continually improve process performance;” PDCA methodology Act How to improve next time? Plan What to do and how to do it. Check Did things happen according to plan? Do Do what was planned

46. Don’t Forget the Human element “ [The man of system] seems to imagine that he can arrange the different members of a great society with as much ease as the hand arranges the different pieces upon a chess-board; he does not consider that the pieces upon the chess-board have no other principle of motion besides that which the hand impresses upon them; but that, in the great chess-board of human society, every single pieces has a principle of motion of its own, altogether different from that which the legislator might choose to impress upon it.” Adam Smith: The Theory of Moral Sentiments, Part VI, Section II, Chapter 2

47. BETTER a FEW Procedures that ARE followed THAN… “Most IT organisations have processes and procedures for how services are delivered for both projects and operations. Often these processes and procedures are codified but not maintained or actively policed...” Iain Parker, The Boxwood Group Source: Computing 1 September 2005

48. Agenda • What is meant by “Process” ? • Types of Processes • The “Process Approach” to Auditing • Auditing the Processes within IT Production • Analysing the Processes within IT Production • “MOPS” Questions • Gap Analysis • Implementing New Processes within IT Production • Evaluating the Success • Processes in the context of “MOPS”

49. Processes in the context of “MOPS” M • Implementing the correct Processes and Procedures is only one part of the total “MOPS” solution. • In order to be effective, Processes need to be backed up by appropriate Operational Tools. • Processes need to be created for defining and updating Architectural IT Production Standards. • Monitoring of Processes requires techniques for collecting Metrics, some of which may be published to the clients. O P S

50. HOW could we get there ? • ANALYSE existing IT Production under the following headings: • Metrics • Operational Tools • Processes and Procedures • Standards • IDENTIFY the gaps • under each of these headings • PRIORITISE • from IT Production perspective, but also…. • ENGAGE with Sponsors and Business • Talk about what we are doing, and why • CREATE an IT Production Strategy • owned by all stakeholders • INCREMENTALLY role out changes to the way the department works Where do you want to go Tomorrow?