Processes: Auditing, Analysing and Implementing

1
Processes Auditing, Analysing and Implementing
Dennis Adams
a s s o c i a t e s

• An approach for implementing Appropriate
  Management Processes into IT Production

Dennis Adams Associates LimitedConsultancy for
IT Production Managementwww.dennisadams.net
2
Introduction MOPS for IT Production

• There are four key elements which we consider are
  necessary for Strategic- Proactive- Management
  of IT Production
• METRICS
• OPERATIONAL TOOLS
• PROCESSES AND PROCEDURES
• STANDARDS
• This presentation will cover how we would
  approach the topic of Processes and Procedures,
  in the context of IT Production Management.
• Many of these techniques are based on ISO 9000
  Guidance.
• ISO 9000 Introduction and Support Package
  Guidance on the Concept and Use of the Process
  Approach for management systems (ISC/TC 176/SC
  2/ N544R2)

3
MOPS Auditing
M

• MOPS auditing involves systematically looking
  at the Organisational structure of an IT
  Production team, and measuring its viabiliy
  against the MOPS criteria
• METRICS
• OPERATIONAL TOOLS
• PROCESSES AND PROCEDURES
• STANDARDS
• This presentation will concentrate on the
  Processes and Procedures side of a MOPS audit.
• NOTE This is not a manual on how to do a MOPS
  Process Audit. It covers the general Approach.
  See other documentation for
• Criteria for appropriate Processes within IT
  Production
• Specific questions to ask
• How to do Gap Analysis

O
P
S
4
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

5
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

6
What is meant by Process ?

• The ISO 9000 guidance defines a process as a set
  of interrelated or interacting activities which
  transform inputs into outputs
• Inputs and Outputs could be
• tangible (equipment, materials, components)
• intangible (energy, information).
• Some Outputs could be unintended (waste,
  pollution).
• Each process has customers or other interested
  parties who may be internal or external to the
  organisation.
• Are affected by the process, and
• Define the required outputs according to their
  needs and expectations
• All processes should be
• Aligned with the objectives of the organisation
• Designed to add value relative to the scope
  complexity of the organisation.

7
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

8
Types of Processes

• The ISO Guidelines identify the following types
  of processes
• Realisation Processes
• Processes which provide the intended output of
  the organisation
• Processes for Management of an organisation
• E.g. Strategic Planning, establishing Policies,
  setting Objectives, providing Communication,
  ensuring Availability of resources needed,
  Management reviews.
• Measurement, Analysis and Improvement processes
• Processes to measure and gather data for
  performance analysis and improving effectiveness
  and efficiency. E.g. Measuring, monitoring,
  auditing, corrective preventative action.
• Processes for managing Resources
• For provision of resources that are needed for
  any of the above

9
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

10
Organisation and Process

• Organisations are usually hierarchically
  organised vertically by Functional units
• E.g. Unix/Window Engineers, DBAs, Network,
  HelpDesk etc.
• Actions are usually focused on the function of
  the unit.
• Problems that occur at the interface between
  units are often given less priority than the
  goals of the unit itself.
• The end customer is not always visible to all
  involved.
• E.g. a problem application arrives at Help Desk,
  and is passed between each team in turn, all of
  whom pass it on as not a problem from my
  perspective
• One solution is to create a multi-discipline SWAT
  team to address the problem holistically.
• The Process Approach introduces horizontal
  management.

11
The Process Approach
Functional Organisation
Process Approach
The Process Approach introduces horizontal
management, crosses the barriers between
different functional units and unifying their
focus to the main goals of the organisation.It
also improves management of process interfaces.
12
Using the Process Approach

• The Performance of an organisation can be
  improved through the use of the process approach.
  The processes are managed as a system, by
  creating and understanding a network of the
  processes and their interactions. (ISO 9000
  Introduction and Support Package)
• The consistent operation of a network of
  processes and their interactions is often
  referred to as the system approach to
  management
• (Not to be confused with the management of
  systems !)
• Outputs from one process may be inputs to other
  processes and interlinked into the overall
  network of processes.

13
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

14
Auditing the Processes within IT Production

• The ISO 9000 guidelines suggest the following
  steps can be followed to identify the processes
  within an organisation
• (5.1.1) Define the purpose of the organisation.
• (5.1.2) Define the policies and objectives of the
  organisation.
• (5.1.3) Determine the processes in the
  organisation.
• (5.1.4) Determine the sequence of the processes.
• (5.1.5) Define process ownership.
• (5.1.6) Define process documentation.
• (Numbers in brackets are from N544R2 guidance)
• In detail..

15
Define the Purpose of the organisation.

• Identify the customers and other interested
  parties
• Their requirements, needs and expectations
• Define the organisations intended outputs.
• Gather, analyse and determine customer and other
  interested parties requirements, and other needs
  and expectations.
• Communicate frequently with customers and other
  interested parties to ensure continual
  understanding of their requirements, needs and
  expectations.
• Determine the requirements for different
  management disciplines within the organisation
  (quality, environmental, health safety,
  business risk, social responsibilities)

In IT Production, our customers are the
business and other IT departments. We need to be
clear on their requirements, needs and
expectations.
16
Define the Policies and Objectives of the
organisation.

• Based on analysis of the requirements needs and
  expectations, establish the organisations
  policies and objectives.
• Top management should decide which markets the
  organisation should address and develop relevant
  policies.
• Based on these policies, management should then
  establish objectives for the intended outputs.

An IT Production division does have the ability
to scope its market to some extent. Some
activities (e.g. desktop support) may already be
outsourced, or could usefully be. If the business
intends to expand into new physical locations,
will the current IT Production be given
responsibility for these?
17
Determine the Processes in the organisation.

• Identify all the processes that are needed to
  produce the intended outputs.
• Determine the processes needed for achieving the
  intended outputs. The process types are
• Realisation
• Management
• Measurement
• Resource
• Identify all process inputs and outputs
• Identify all suppliers, customers, and other
  interested parties.

Many IT Production organisations have implicit
processes, embedded in the culture. If these can
be identified, they are a strong basis for
building on.
18
Determine the Sequence of the processes.

• Determine how the processes flow in sequence and
  interaction.
• Define and develop a description of the network
  of processes and their interaction.Consider the
  following
• The customer of each process.
• The inputs and outputs of each process.
• Which processes are interacting.
• Interfaces and what are their characteristics.
• Timing and sequence of the interacting processes.
• Effectiveness and efficiency of the sequence.
• E.g. a Realisation process will interact with a
  Management, Measurement or Resource Process.
• Block diagrams, matrix and flowcharts !

Looking at the Sequence of Processes within IT
Production (e.g how and when we Measure the
Realisation processes) can bring valuable insight
into how efficiently we are achieving our
objectives.
19
Define process Ownership.

• Assign responsibility and authority for each
  process.
• Management should define individual roles and
  responsibilities for ensuring the implementation,
  maintenance and improvement of each process and
  its interactions. (The Process Owner)
• To manage process Interactions, it may be useful
  to establish a process management team that has
  an overview across all the processes, and which
  includes representatives from each of the
  interacting processes.

The is considerable benefit to an IT Production
team in making implicit (cultural) processes
explicit, and assigning someone to be responsible
for them. External consultants who understand IT
Production may be in a position to help do this.
20
Define process Documentation.

• Determine those processes that are to be
  documented and how.
• Processes already exist within an organisation,
  and the initial approach should be limited to
  identifying and managing them in the most
  appropriate way. There is no necessity for a
  massive global catalog of processes.
• The main purpose of documentation is to enable
  the consistent and stable operation of the
  process.
• Determine which processes are to be documented
  based on
• Size of the organisation and the type of its
  activities
• Complexity of the processes and their
  interactions
• Criticality of the processes
• Availability of people to do the documentation !
• Graphical designs, written instructions,
  checklists, flowcharts, visuals interactive web
  sites.

21
Auditing - Summary

• Auditing Steps
• Define the Purpose of the organisation.
• Define the Policies and objectives of the
  organisation.
• Determine the Processes in the organisation.
• Determine the Sequence of the processes.
• Define process Ownership.
• Define process Documentation.

The result of this activity would be a Process
Landscape, which would show us what processes
are already in place, and help us identify the
gaps. From an IT Production perspective, we
should have a clear understanding of our purpose,
policies and objectives, so we need to
concentrate on the Gap Analysis
22
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

23
MOPS Questions

• A key part of the MOPS approach is to implement
  solutions based on a pragmatic understanding of
  the real issues in IT Production.
• Process implementation needs to focus on the
  Objectives of IT Production.
• Typically, this involves efficiency and
  effectiveness.
• At the same time, it may be possible to look at
  Operational Tools as a means of automating the
  processes.

24
WHERE do we WANT to be ?

• Visibility of Activity to identify the "problem
  applications" that take a disproportionate
  percentage of support effort.
• This enables the Business as a whole to
  understand the true lifecycle costs of all
  Applications.
• Predictable Cost growth (such as headcount), and
  Infrastructure costs (such as CPU, memory, disk
  storage etc.)
• so that resources and infrastructure can be
  purchased in good time, with appropriate cost
  savings.
• Clear Infrastructure Standards and Service Levels
• So that IT Development can understand what
  technologies can be supported by IT Production,
  and at what costs.

25
THE DREAM of Strategic IT Production

• Smooth deployment of Projects, as a result of
  clear handover procedures to IT Production, and
  IT Production's involvement with Projects at
  Initiation side, to ensure that Support is
  viable.
• Justify the IT Production Budgets against clearly
  agreed Performance Metrics.
• Engage with the Business sponsors, and
  successfully argue the case for increasing IT
  Infrastructure Investment, rather than fighting
  up-hill budget reduction policies that don't take
  into account Infrastructure needs.
• Function as a Managed Team, rather than just
  event-driven "fix-it ".

Using a Strategic Approach, IT Production
Managers can make their teams more Pro-Active
more Client-focused, and be in a better position
to justify IT Infrastructure Investment
26
PROCESSES and PROCEDURES should

• Facilitate the day-to-day running of IT
  Production, and it's relationship with the
  Business Sponsors and IT Development
• Facilitate rapid Deployment of Projects to live,
  upgrade, change controls processes etc.
• Enable changes to Production Standards (hardware
  O/S upgrades etc.) and procedures to ensure
  that IT Development work and Business Sponsorship
  is visible to the IT Production team.
• Enable a clear interface with Development
  Projects at the earliest possible phase.

Dont overload your teams with Procedure. Use a
pragmatic common-sense approach.
27
The BEST WAY to Implement ITIL Service
Management?
Service Desk
Incident
Problem
Change
Release
Configuration
Configuration Management Database (CMDB)
28
or MORE LIKE THIS ?
Service Desk
Incident
Problem
Change
Release
Configuration
Configuration Management Database (CMDB)
29
Gap Analysis

• Once we have identified the current processes, we
  can use the ITIL framework (or BS 15000 or CMMi)
  to identify the gaps.
• Note, however, that we should concentrate on the
  overall IT Production department as a whole.
• It is important that we understand where the
  inputs and outputs of IT Production exist.
• Problems with Process typically arise in the
  Interfaces to those processes, not the processes
  themselves.

30
PROCESSES / PROCEDURES to IMPLEMENT

• ITIL Service Management provides a valuable
  framework within which to define your processes
• Service Desk, Incident and Problem Mangaement,
• Change and Release Management
• Configuration (Asset Management)
• In Addition, it is important to highlight the
  Process INTERFACES between IT Production and the
  outside world.
• Project Deployment, Handover.
• Involvement with Production at Project
  Initiation, linked to Standards
• Sponsorship of RD within the Production team.

31
INTERFACING PROCESSES
Initiation
R D
Configuration
Build
Release
Standards
Change
AGILE
Problem
Deploy
Handover
Incident
Support
Service Desk
32
Reminder Advantages and Disadvantages of
PROCESSES

• Advantages of Process
• SOX, CMMI, ISO 9001, ISO 10000-3
• Reduction in Costs
• Predictable, Repeatable, Auditable, Verifiable
• Disadvantages
• Can become onerous
• Not always reflecting the need to be highly
  responsive.
• Conclusion
• Deploy Processes which deliver value-add to IT
  Production and its clients.

33
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

34
Implementing New Processes within IT Production

• The ISO 9000 guidelines suggest the following
  steps can be followed to plan a new process
  within an organisation
• (5.2.1) Define the activities within the process.
• (5.2.2) Define the monitoring and measurement
  requirements.
• (5.2.3) Determine the resources needed.
• (5.2.4) Verify the process and its activities
  against planned objectives
• (Numbers in brackets are from N544R2 guidance)
• In detail..

35
Define the Activities within the process.

• Determine the activities needed to achieve the
  intended outputs of the process.
• Determine the required Inputs and Outputs of the
  process.
• Determine the activities required to transform
  the inputs into the required outputs.
• Determine and Define the Sequence and Interaction
  of the activities within the process.
• Determine how each activity will be performed.
• (In some cases, the customer may specify the way
  the process is to be performed)

It is helpful to think of IT Production Processes
as Transformations from an input (a support
call) to an output (a satisfied end-user)
36
Define the Monitoring and Measurement
requirements.

• Determine where and how measuring and monitoring
  should be applied. This should be both for
  control and improvement of the processes, as well
  as for the intended process outputs.
• Determine the need for recording results.
• Identify the measures and and monitoring criteria
  for process control and process performance, to
  determine the effectiveness and efficiency of the
  process, taking into account
• Conformity with requirements
• Customer satisfaction
• Supplier performance
• On time delivery
• Lead times
• Failure rates
• Waste
• Process costs
• Incident frequency

37
Determine the Resources needed.

• Determine the resources needed for the effective
  operation of each process.
• Examples of resources include
• Human Resources
• Infrastructure
• Work Environment
• Information
• Natural Resources
• Materials
• Financial Resources.

There may be Resource Trade-offs
IT Production Service Support may be manpower
intensive. Provision of a test lab environment
for reproducing problems could reduce manpower
costs drastically.
38
Verify the process and its activities against
planned objectives

• Confirm that the characteristics of the process
  and its activities are consistent with the
  purpose of the organisation.
• Verify that all the requirements identified
  earlier are satisfied.
• If not, consider what additional processes may be
  required.
• How can the process be improved?

Our objective as an IT Production team is to
deliver the best possible support function to the
end-users. Appropriate Processes can be a
valuable means to this end.
39
Additional Factors when Implementing Processes

• When implementing new Processes, you should also
  consider how to address the following
• Communication of the new Processes
• Awareness
• Process Training for the actors
• Change Management
• How to change the current processes (if any) into
  the new ones.
• Management Involvement
• Review Activities after the processes have been
  implemented.
• Are the appropriate Measurement, Monitoring and
  Controls in place ?

40
Implementing - Summary

• Implementation Steps
• Define the activities within the process.
• Define the monitoring and measurement
  requirements.
• Determine the resources needed.
• Verify the process and its activities against
  planned objectives
• Additional Factors

In practice a Small number of Simple processes,
communicated, understood, adhered to and
maintained, are of more benefit than A Large
number of Complex processes not communicated, not
understood and never followed !
41
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

42
Evaluating the Success

• Before embarking on work to audit and implement
  new processes, it is important to have
  pre-defined success criteria.
• Evaluate the process data (obtained from the
  Monitoring and Measuring processes!) to quantify
  process performance.
• Compare the results of process performance
  measurements with the defined requirements of the
  process
• Confirm process effectiveness efficiency
• Any need for corrective action
• Identify process improvement opportunities based
  on process performance data.
• Report to Management on the performance of the
  Process.

IT Production can enhance its visibility and
credibility by reporting on process improvements
it has implemented.
43
Improving the Processes

• As well as implementing new processes, we should
  also define a method for implementing corrective
  actions / improvements.
• If the process is not working what are the root
  causes?
• Human errors?
• Defect in the process itself?
• Insufficient process control?
• Once the process requirements are achieved, focus
  efforts on improving them !
• Define a method for improving processes
• Process simplification
• Enhancement of efficiency
• Improvement of effectiveness
• Reduction of process cycle time.
• Verify the effectiveness of the improvement.

44
Risk Analysis

• Risk Analysis techniques can be used to identify
  potential problems with our new process
• Identify the root cause(s) of these potential
  problems
• Address the root causes.
• This may prevent occurance in other processes
  with similarly identified risks.

IT Production can enhance its visibility and
credibility by reporting on process improvements
it has implemented.
45
PDCA methodology

• Plan
• Establish the objectives and processes necessary
  to deliver results in accordance with customer
  requirements and the organization's policies
• Do
• Implement the processes
• Check
• Monitor and measure processes and product against
  policies, objectives and requirements for the
  product and report the results
• Act
• Take actions to continually improve process
  performance

Plan What to do and how to do it.
Act How to improve next time?
Check Did things happen according to plan?
Do Do what was planned
46
Dont Forget the Human element
The man of system seems to imagine that he
can arrange the different members of a great
society with as much ease as the hand arranges
the different pieces upon a chess-board he does
not consider that the pieces upon the chess-board
have no other principle of motion besides that
which the hand impresses upon them but that, in
the great chess-board of human society, every
single pieces has a principle of motion of its
own, altogether different from that which the
legislator might choose to impress upon it.
Adam Smith The Theory of Moral Sentiments, Part
VI, Section II, Chapter 2
47
BETTER a FEW Procedures that ARE followed THAN
Most IT organisations have processes and
procedures for how services are delivered for
both projects and operations. Often these
processes and procedures are codified but not
maintained or actively policed...
Iain Parker, The Boxwood Group Source Computing
1 September 2005
48
Agenda

• What is meant by Process ?
• Types of Processes
• The Process Approach to Auditing
• Auditing the Processes within IT Production
• Analysing the Processes within IT Production
• MOPS Questions
• Gap Analysis
• Implementing New Processes within IT Production
• Evaluating the Success
• Processes in the context of MOPS

49
Processes in the context of MOPS
M

• Implementing the correct Processes and Procedures
  is only one part of the total MOPS solution.
• In order to be effective, Processes need to be
  backed up by appropriate Operational Tools.
• Processes need to be created for defining and
  updating Architectural IT Production Standards.
• Monitoring of Processes requires techniques for
  collecting Metrics, some of which may be
  published to the clients.

O
P
S
50
HOW could we get there ?

• ANALYSE existing IT Production under the
  following headings
• Metrics
• Operational Tools
• Processes and Procedures
• Standards
• IDENTIFY the gaps
• under each of these headings
• PRIORITISE
• from IT Production perspective, but also.
• ENGAGE with Sponsors and Business
• Talk about what we are doing, and why
• CREATE an IT Production Strategy
• owned by all stakeholders
• INCREMENTALLY role out changes to the way the
  department works

Where do you want to go Tomorrow?
51
Processes Auditing, Analysing and Implementing
Dennis Adams
a s s o c i a t e s

• An approach for implementing Appropriate
  Management Processes into IT Production

Dennis Adams Associates LimitedConsultancy for
IT Production Managementwww.dennisadams.net