Scaling Agile in Regulated Environments: Addressing the Challenges of Compliance with Applied SAFe

PEDCO – Bringing SAFe® to LIFE©PEDCO AG | Applied SAFe® | Challenges of Compliance | February 2019 Page 1
February 2019
Peter Pedross, PEDCO – CEO & Founder
Scaling Agile in Regulated Environments:
Addressing the Challenges of Compliance
with Applied SAFe

Peter Pedross
CEO & Founder
Phone: +41 76 373 35 95
E-Mail: peter.pedross@pedco.eu
Web: www.pedco.eu
Peter Pedross
• 30+ years experience in Software Engineering.
• Studied Software Engineering, Finance and
Management Psychology
• World-wide responsible for lifecycles, processes,
methods and tools at a leading Swiss financial
institute
• 50+ publications and lectures since 1995 in USA,
Japan and Europe.
• Certified in "Scaled Agile Framework" and
"Disciplined Agile Delivery", EFQA, CMMI, PMI.
• Encountered first experience with Agile in 1999 (XP)
• President of the Board for Computer Science at the
Swiss Association of Quality and member of the
Board of Directors.
CEO AND FOUNDER OF PEDCO

Content 1. Context
2. Compliance meets Agile Development
3. Motivation for a process model
4. Role of the Quality Management System
5. What is Applied SAFe?
6. Real live examples:
➢ Have a defined process
➢ Ensure process compliance
➢ Manage process variations
➢ Build quality in
➢ Continuously Verify and Validate
➢ Establish a Lean-Agile Learning Organization
7. Lessons Learned
8. Conclusion
9. Discussion, Q&A

Context
• Increasing competitive pressure
• High innovation levels and high efficiency
• Low time-to-market
• Industry 4.0, Lean Start up, Agile
• Cyber-physical systems, increased complexity and dependency
• Just agile teams are to small to build complex systems
• Regulatory and organisational environment is becoming ever more
demanding
• Most agile delivery teams face compliance requirements
(regulatory and/or organizational).
• Strategy and governance steering is needed
WHY SCALED AGILITY IN REGULATED ENVIRONMENTS?
POLL

Trends in Scaled Agility (12th State of Agile Report by Version One; April 2018)
OVERVIEW IN USAGE OF THE MOST COMMON AGILE FRAMEWORKS

SAFe® - #1 Framework for Scaled Agility
SCALING UP FROM TEAM TOWARDS PROGRAM, LARGE SOLUTION, PORTFOLIO AND ENTERPRISE
More Details on www.scaledagileframework.com
1. Alignment
2. Built-In Quality
3. Transparency
4. Program execution
Core Values

Compliance meets Agile Development
CONTRASTING TRADITIONAL REGULATORY AND COMPLIANCE CONCERNS WITH AGILE VALUES

LEAN-AGILE QMS IMPROVES QUALITY AND MAKES COMPLIANCE MORE PREDICTABLE
Implementing a QMS for Lean Agile Organizations

Scaled Agile Framework® (SAFe®)?
Build the Solution incrementally
• Apply fast Learning Cycles
• Apply objective Milestones based
on Progress, Product, Process
Metrics
Organize around Value
• Understand the full Value Stream
• Synchronize with PI Planning
(Dependencies, Risks, Priorities)
Build Quality in
• Solution Intent as a critical
Knowledge Repository
• MBSE facilitates emergent
Specifications
Apply continuous Verification and
Validation (V&V)
• Include Compliance Concerns in
Definition of Done (DoD)
• Inspect & Adapt and frequent V&V
reduce Risk and increase Assurance
… HAS MOST OF THE HOOKS NEEDED FOR COMPLIANCE WITH HIGH ASSURANCE SYSTEMS
POLL

Applied SAFe®
Implementation of a Lean Agile QMS based on SAFe

Applied SAFe®
A CUSTOMIZABLE IMPLEMENTATION OF SAFE® AS A PROCESS MODEL
Customize
and Extend
Develop
Compliant
Implement SAFe®
Fast & Precise
Learn, Innovate,
and Improve

Applied SAFe®
PROVEN BENEFITS
Customization and Compliance

VARYING LEVELS OF CRITICALITY, FROM SAFETY-CRITICAL TO SECURITY-CRITICAL
Scaled Agility in Regulated Environments
• Quality:
Have a managed process & established QMS
• Safety and Security:
Transparency in Execution & Continuous Compliance
• Effectiveness: Manage Process & Solution
variations, reduce waste and do exactly what is
needed
• Traceability:
• Ensure process & product compliance
• Coverage, completeness
• Verification and Validation:
• Engineering based on Principles & Practices
• Quality of code, system and documentation.

Quality:
Have a Defined Process & an Established QMS

Have a Defined Process
• Tom is new to the company
• He has several years experience in IT and has been
working in an agile team.
• He loves to code and to test, but hasn’t that much
experience with Scaled Agility yet.
• Tom has been working in a small Scrum-team and
has some basic knowledge about SAFe®.
• Tom is interested to see, how epics are handled on
a Portfolio Level at his new company.
DEMO OF APPLIED SAFE®

Traceability:
Ensure Process Compliance

Mapped,harderforAssessment&QA,
optimizedforusageincompany
Process Design for regulated Environments
PROCESSES NEED TO COMPLY, NOT TO REPLICATE A REFERENCE MODEL
Reference Model
• Process Area 1
• GP 1.1
• GP 1.2
• …
• Work Products
• WP 1
• WP 2
• …
Company Process Model
• Process Area 1
• GP 1.1
• GP 1.2
• …
• Work Products
• WP 1
• WP 2
• …
Easy for
Assessment
CMMI
• Process Area X
• GP x.1
• GP x.2
• …
• Work Products
• WP x1
• WP x2
• …
AS9100
• Process Area Y
• GP y.1
• GP y.2
• …
• Work Products
• WP y1
• WP y2
• …
A-SPICE 3.0
• Process Area Z
• GP z.1
• GP z.2
• …
• Work Products
• WP z1
• WP z2
• …
Custom
• Process Area W
• GP w.1
• GP w.2
• …
• Work Products
• WP w1
• WP w2
• …
My Company Process Model
• Epic Kanban
• What I do
• The way we like it
• Is better for us
• Work Products
• SAD
• CM Plan
• …
• Roles
• Business Owner
• Developer
• Tester
Spec with
text / model
_____
AAAAA
BBBBBB
Spec with
text / model
_____
AAAAA
BBBBBB
Spec with
text / model
_____
AAAAA
BBBBBB
Spec with
text / model
_____
AAAAA
BBBBBB

...and identify gaps.
Assure Compliance to Reference Models
ENSURE COMPLIANCE WITH A SUSTAINABLE MECHANISM; AVOID INTERPRETATION GAMES
Map standard requirements...
...to defined process assets
© PEDCO AG 2019, Applied SAFe® all rights reserved

Transparency in Execution and
Continuous Compliance
• Linda is the Agile Release Train Engineer
• The program has run two PI’s so far.
• Linda needs to get an approval from an assessment for
compliance with there regulated requirements
• Convince assessor that the program has a defined process
variation
• Prove that they know what, why and how they are ensure
the stakeholder requirements.
DEMO IN APPLIED SAFE WITH PI PLANNING

AAMI: TIR 45
GUIDANCE ON THE USE OF AGILE PRACTICES IN THE DEVELOPMENT OF MEDICAL DEVICE SOFTWARE
© 2012 Association for the Advancement of Medical Instrumentation AAMI TIR45:2012
http://www.pedco.eu/tir45-agile-in-medical/

Effectiveness:
Manage process variations

Different use of Process Instances on
Defined Levels
OVERVIEW OF INSTANTIATIONS WITH DIFFERENT CONFIGURATIONS OF THE SAFE® MODEL

Workspace and Instantiations in the real World
A Swiss Banking Institute Example
Process Instantiations can be done on any given level.

Manage Process Variation
• Linda is an Agile Release Train Engineer
• Linda knows the company very well
• The program has run one PI so far.
• Linda has several years experience in IT and project
management.
• Linde loves to manage and is PMI-certified Project
Manager.
• She is also certified Scaled Agilest and has some
knowledge of SAFe.
• Linda wants to tailor the process accordingly to
what was decided during I&A
DEMO IN APPLIED SAFE

Verification & Validation:
Engineering based on SAFe® Principles & Practices
Solution Intent and Solution Context
Model-based Systems Engineering (MBSE)
Definition od Done (DoD)

RAPID LEARNING CYCLES INCREASE QUALITY AND REDUCE RISK
Build Solution and Compliance Incrementally

Example: Solution Intent in SAFe
WHAT DOES THE CURRENT SYSTEM NOW, AND WHAT CHANGES ARE INTENDED FOR A FUTURE STATE
Source: www.scaledagileframework.com

Solution Intent
APPLICATION IN DETAIL
Source: www.scaledagileframework.com

Context, theory with Applied SAFe
HOW DO YOU WORK WITH DEFINITIONS OF DONE?

Definition of Done
MAKE V&V AND COMPLIANCE ACTIVITIES PART OF REGULAR FLOW

Applied SAFe: Concepts
DEFINITION OF DONE (DOD) IN SCALED AGILITY

Relentless Improvement:
Establish a Lean-Agile Learning Organization

Quality Processes for Mature Agile Organizations
METHODS AND PROCESSES FOR COMPLIANCE WITHIN REGULATED ENVIRONMENTS

Lessons Learned

Lessons Learned (1/2)
Read/use available sources; e.g:
• Software Engineering Institute:
‘Scaling Agile Methods for
Departments of Defense Program
• CMMI Institute:
‘A Guide to Scrum and CMMI’
• TIR45 from AAMI: ‘Agile practices
in the development of medical
device software’
Be very clear on what is compliance and what is not.
• Mapping of scaled agility to reference model is surprisingly
straight forward, once the lean-agile mindset is understood
• Avoid the bear trap: Map compliance elements always to value
adding deliverables
• Automate mechanisms to prove mapping to reference models
-> reduce discussion time and interpretation games
• Some reference models ask for process- and product-specific
requirements -> Scope those requirements for purpose
Compliance is often a ‘negotiation game’
• Don’t forget the human element of stakeholders & appraisers
• Solution Intent and agile Design control needs to be established
Demonstrate compliance in small iterations based on flow’
• Avoid ‘quality depth’; do not ‘build in’ compliance at the end of
development
• Treat audits like a normal system demo
• Focus on outcomes
OF SCALED AGILE APPLICATIONS/MAPPINGS TO VARIOUS REFERENCE MODELS

Lessons Learned (2/2)
Some experiences:
• A mapping of Scaled Agile
Frameworks to reference
models is achievable within a
lower number of weeks.
• Depending on the attributes
of a solution or on existing
documentation the form of
‘DoD’s can vary very much.
• Commercial frameworks such
as SAFe® or others are an
excellent starting point to be
applied in the development of
high assurance systems.
Separate ‘What shall be done’ from ‘How something is done’
• Model only necessary steps in the process
• Build and rely on heuristics to model the process for usage
• Ensure that practices can be changed/selected easily by
performers
Quality Management System
• Let the QMS be easily accessible and easy to use.
• Promote transparency for each endeavor, process instantiations
need to be specialized to reduce waste.
• Allow fast process changes and pilot in appropriate levels.
• Allow process users to perform tailoring themselves in a
controlled and easy way. Trust that they will do it good!
OF SCALED AGILE APPLICATIONS/MAPPINGS TO VARIOUS REFERENCE MODELS

Conclusion

Scaled Agility can be successfully applied in
regulated environments!
Agile practices for reg. env. in
SAFe:
• Build the solution
incrementally
• Apply fast learning cycles
• Apply objectives milestones
• Demo frequently; routinely
deliver objective progress,
product, and process metrics
• Organize around value
• Build quality in
• Apply continuous verification
and validation
• Include compliance concerns
in Definition of Done
• Solution intent as concept for
requirements
• Inspect & Adapt lead to
continuous improvement
FRAMEWORKS HAVE MOST OF THE HOOKS NEEDED FOR COMPLIANCE WITH HIGH ASSURANCE SYSTEMS
✓ Read and understand the regulations! Strive to map existing
agile behavior and don’t impose unnecessary work.
✓ Regulated requirements have common background!
✓ Regulations do not imply how some thing shall be done.
Use given freedom and map agile practices ->
✓ Not all regulations are as stringent as others; tailoring of
processes is a must to reflect applicable regulations.
✓ Establish a managed process and Quality Management System
(QMS)
✓ Address live cycle concerns of solutions (e.g. live time)
✓ Build your own Lean Agile Center of Excellence (LACE)
✓ Include executive level in the cultural change
✓ Lead the change, it won’t be easy
✓ Define governance and responsibilities, also on an Enterprise
level
✓ Exchange your experience with others!

Applied SAFe Value Proposition
ADVANTAGES FOR YOU
Customize
and Extend
Develop
Compliant
Implement SAFe
Fast & Precise
Learn, Innovate,
and Improve

Questions? Discussion?

Tel. +41 44 542 45 45
www.pedco.eu
pedco@pedco.eu
PEDCO AG
Zelgstrasse 5
CH-8003 Zürich

Scaling Agile in Regulated Environments: Addressing the Challenges of Compliance with Applied SAFe

More Related Content

What's hot (20)

Similar to Scaling Agile in Regulated Environments: Addressing the Challenges of Compliance with Applied SAFe (20)

More from Cprime (20)

Recently uploaded (20)

Scaling Agile in Regulated Environments: Addressing the Challenges of Compliance with Applied SAFe