Oct 13 - 19, 2003 



Many companies, within and outside Pakistan, insist on dealing with only those IT organizations that can demonstrate a high level of quality management. In this context, the Software Engineering Institute's Capability Maturity Model (CMM) has become the most influential quality management model for improving the software process in the IT industry worldwide. Alternative programs, such as the ISO 9000 series, Deming's Continuous Quality Improvement (CQI), Baldridge, and others have proven beneficial and effective within the IT community, but CMM provides an edge that has been recognized and appreciated.

CMM, from its inception, was designed specifically for the software engineering process, whereas the others are generic quality programs applicable to any manufacturing/services industry. This makes it relatively compact, easier, and more cost-effective to implement. CMM is a robust model which, when properly implemented, effectively reduces risk the risk of ineffective planning, the risk of cost overruns, the risk of misinterpretation, and the risk of unpredictability and raises quality in a measurable way.

The IT organizations that operate under CMM guidelines and recommendations have a strong tendency to be much more efficient and responsive than those which do not. The latter type, like most in Pakistan, can at times produce excellent results too. Yet the success of such organizations is generally due to the heroic efforts of an individual or a dedicated team on a one-off basis, rather than through repeating the proven processes of an organization. Thus the repeatability of success is not guaranteed.

A big problem with such organizations is that they are unpredictable because the process is constantly modified as the work progresses. Schedules, budgets, functionality, and product quality are generally unpredictable. Predictability is inversely proportional to risk; the higher the predictability in an organization the lower is the risk involved.

Another problem is that very little learning goes on in the environment. This is because efforts from project to project are not measured or documented, and thus they are not repeatable or shareable. New projects do not get the benefit of best practices on prior projects. Instead it takes heroic individual efforts to carry the project through.

These are some of the basic problems faced by the IT organizations in Pakistan. Without an organized strategy for improvement, such as CMM based process improvement, it is difficult to achieve consensus on what improvement activities to undertake to eradicate these problems. To achieve lasting results from process improvement efforts, it is necessary to design an evolutionary path that increases an organization's software process maturity in stages. Thus, an improvement strategy provides a roadmap for continuous process improvement. It guides advancement and identifies deficiencies in the organization; it is not intended to provide a quick fix for projects in trouble.



To achieve the level of quality associated with CMM, the Professional Services division of NCR Pakistan was successfully assessed on August 14, 2003 under the CMM Based Appraisal Internal Process Improvement (CBA IPI), an assessment methodology for the Software-CMM model. The initial rating achieved was of Level 2, with Level 3 being targeted as the next milestone of the continuous process improvement plan of NCR Professional Services. Level 2 is a project-focused effort. It is not designed to bring the entire organization to process maturity. The focus is on repeating the processes from project to project, studying the results, and improving for the next. The intent is to establish and implement basic processes on individual projects; once they have become refined enough to be proven generally successful, they can be institutionalized (at Level 3) across the organization.

In the words of SEI lead Assessor Ron Weidemann, "NCR Pakistan has achieved a very clear and solid Level 2 assessment. They achieved this in half the time it normally takes. Management sponsorship was the key to the success of this initiative". In the last two years NCR Professional Services has become a Centre of Expertise for the entire region, taking charge of implementations for customers across the Europe, Middle East and Africa (EMEA). CMM Level 2 certification further establishes NCR Professional Services as an IT organization with the capability, processes, and credentials to deliver its commitments.

The purpose of adopting CMM based process improvement by NCR Professional Services is to assist the organization in the maturing process. The word "mature" here means an environment in which predictability is high and the risk is low.

CMM is structured as a five-tier scale: Initial; Repeatable; Defined; Managed; and Optimizing. If an organization assesses at the Optimizing Level (Level 5) on the scale, it has reached full maturity. Full maturity implies that the entire organization is focused on continuous process improvement. The SEI estimates that only about 1 to 2 percent of organizations worldwide operate at Level 5. In Pakistan, there are currently only two organizations which are CMM certified, NCR Professional Services being one of them.

An organization that assesses at the Initial Level (Level 1) naturally lacks these abilities, and so quality becomes an unpredictable or an unmanageable goal. Success here is not so much dependent on the organization as it is on the individual. Quality on the first tier is achieved through heroic individual efforts; it is neither a planned nor an organized process. The SEI estimates that the vast majority of IT organizations around the world would assess at Level 1 on the CMM scale.

As an organization proceeds from one maturity level to the next, the range of benefits from its improvement activities and processes increases substantially. Since improvements at each maturity level solve different sets of problems, different benefits emerge at each level. These benefits are summarized in the table below:



5: Optimizing

Continuously targeting improvements required to meet business needs.

4: Managed

Predictable results. Knowledge of factors causing variance and reuse.

3: Defined

Meeting cost and functionality targets as well as improved quality.

2: Repeatable

Meeting schedule and reduced turnover resulting from less overtime.

1: Initial

No Benefits: Inconsistency; schedule/budget overruns; defective applications

Source: Teraquest



Many of the initial benefits from CMM-based improvement programs result from eliminating rework. In low-maturity organizations, developers or their managers too often commit to schedules that cannot be achieved without heroic effort. However, the evidence indicates that they actually take longer than projects with lengthier estimated schedules. This happens because they are forced into extensive rework on top of the actual effort required to produce the application on a disciplined schedule.

By achieving CMM Level 2, the organization is transformed from being people-centered to being process-centered. That is not to say that CMM does not care about people. As important as people are, what is needed is a set of generic processes and procedures that drives the projects in a consistent, definable, and repeatable manner. At Level 2 the organization turns from depending solely on the project's talent pool to management through process. The organization moves from a degree of unpredictability to a greater degree of prediction.

The "Repeatable" label of Level 2 implies two things. The first is a process: the organization has to have something to repeat. And the second is learning: the organization has to study how the process worked on one project, keep what worked well, discard what did not, and then refine the process for the next project. That is continuous quality improvement in a nutshell.

The CMM is a practical process quality framework, one that has been shown to work time and again, across a wide variety of software development organizations. If it is implemented properly, the organization will reap a series of distinct, tangible benefits. The organization will operate in an environment that is more predictable, where risk is reduced. There should be a rise in quality, a drop in errors, misdirection, and faulted assumptions. And, at the highest level, increased software quality, a better focused work force, and increased client satisfaction. Ultimately, the journey through the succession of CMM levels is underscored by short and long term benefits that constitute continuous improvement.


1. Persse, James R. Implementing the Capability Maturity Model. New York: John Wiley & Sons, Inc., 2001.
2. http://www.sei.cmu.edu

ABOUT THE AUTHOR: Saadia Khalid is currently working with Teradata, a division of NCR as a Professional Services Consultant. She has played a key role in the NCR Professional Services CMM certification effort and also works as a quality management specialist. Her work has contributed significantly in the development and improvement of organizational policies and processes for producing quality deliverables for our customer. She is currently working towards the Level 3 assessment.